2ee1a6856163f8b3477659e9d787a8fd5796df896ec83dbf1521fa77c0112511

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 00:37

Target

017740ea4e858977404ab4716b964538_JaffaCakes118.dll
Size

15KB
MD5

017740ea4e858977404ab4716b964538
SHA1

281c67bd679004eb0c7ca54534fc3c18227915b8
SHA256

2ee1a6856163f8b3477659e9d787a8fd5796df896ec83dbf1521fa77c0112511
SHA512

5f46b1aa85d8245eed3a7e9dbaf0ae490f78b88d3dcaaf58494a2c430e64d6846aabd53025ce80e7494c9be50dfa12c10cf02e92049e7f6bf1c7cd71e3573621
SSDEEP

384:Y6oAsYk9b8x894A+l/49eXb8vlrh49pCMFGT/NzWj:pw1b8W94XVlMO9NmG

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 2204	108	rundll32.exe	28
PID 108 wrote to memory of 2204	108	rundll32.exe	28
PID 108 wrote to memory of 2204	108	rundll32.exe	28
PID 108 wrote to memory of 2204	108	rundll32.exe	28
PID 108 wrote to memory of 2204	108	rundll32.exe	28
PID 108 wrote to memory of 2204	108	rundll32.exe	28
PID 108 wrote to memory of 2204	108	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\017740ea4e858977404ab4716b964538_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\017740ea4e858977404ab4716b964538_JaffaCakes118.dll,#1
  2⤵
  PID:2204

memory/2204-1-0x0000000025018000-0x0000000025019000-memory.dmp

Filesize
4KB

Download
memory/2204-0-0x0000000025000000-0x0000000025020000-memory.dmp

Filesize
128KB

Download