ecb04ce2dde9fe76279c355a6632216492148fe1d90c3d5a11562d0e42b04420

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 01:13

Target

01a3f1e8608c31507684226c27092cb3_JaffaCakes118.dll
Size

47KB
MD5

01a3f1e8608c31507684226c27092cb3
SHA1

38cafbe407278b260940a2dce9d504c342e85a21
SHA256

ecb04ce2dde9fe76279c355a6632216492148fe1d90c3d5a11562d0e42b04420
SHA512

91f96295e5262163410f1eb6c57de5c2edf746cc94c6f3c91e3dfd9fc3559966b523873ec387cc49cff94d4d5f9d89cddf5fce566782a7ed271e8e42ecb88dc2
SSDEEP

768:DSnMqulsz6iAA7r4Mqi/AdzCvRlLxA9uk8MAzDhjSWT+6Fy:WnMqulsGiVAZCLCILFy

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
112	rundll32.exe
112	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 112	2132	rundll32.exe	28
PID 2132 wrote to memory of 112	2132	rundll32.exe	28
PID 2132 wrote to memory of 112	2132	rundll32.exe	28
PID 2132 wrote to memory of 112	2132	rundll32.exe	28
PID 2132 wrote to memory of 112	2132	rundll32.exe	28
PID 2132 wrote to memory of 112	2132	rundll32.exe	28
PID 2132 wrote to memory of 112	2132	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01a3f1e8608c31507684226c27092cb3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01a3f1e8608c31507684226c27092cb3_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:112

memory/112-0-0x0000000000130000-0x0000000000140000-memory.dmp

Filesize
64KB

Download