113fd3586827be213c378612f37f1ddc6bc2d5fc3e35730d2de89dee02934fd9

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 01:14

Target

01a430c2b09f8c8b6cb3d45cfc0a446d_JaffaCakes118.dll
Size

89KB
MD5

01a430c2b09f8c8b6cb3d45cfc0a446d
SHA1

36347a09d409b2d3aca98fb263bdcafe745c7a01
SHA256

113fd3586827be213c378612f37f1ddc6bc2d5fc3e35730d2de89dee02934fd9
SHA512

be401cadfccd145a1215ac59dfc77e64d91d97def1f090c8977df1daae496ba91608350b315e9ff41aa4c65cfc06e86b4bc9fd14a9548cf86fee9a8520519d91
SSDEEP

1536:tOkjA7gyy5i6pXURXtA5Qee2bQRYCH3cYfpHsgQe:tqQ5iPQ59z+YCXlHsg9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01a430c2b09f8c8b6cb3d45cfc0a446d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01a430c2b09f8c8b6cb3d45cfc0a446d_JaffaCakes118.dll,#1
  2⤵
  PID:1924

memory/1924-0-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download