e8fb6675b17a1c9f717201609f818685598ac37ebc48336aa2d4b20342555358

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 02:04

Target

01e6259a8d8217db4f7387f5b596b4a3_JaffaCakes118.dll
Size

460KB
MD5

01e6259a8d8217db4f7387f5b596b4a3
SHA1

4e1aa13939956a74b7d405cbfa83eb2fe17d1b48
SHA256

e8fb6675b17a1c9f717201609f818685598ac37ebc48336aa2d4b20342555358
SHA512

5571b1331936f8f6a04aeb7f41b69efbd0267a315ee07f42852cdc2c05bfb9aef1eabe79ea7792d3f20542b609d9cb151196ed11909e3e89d81f4215ef87b707
SSDEEP

12288:xjzRVbIKYEhWdr5fkXi8CtMgfDDP0QghPKyK:xjzRVbqwWN5fkXi84O0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2236	2248	rundll32.exe	28
PID 2248 wrote to memory of 2236	2248	rundll32.exe	28
PID 2248 wrote to memory of 2236	2248	rundll32.exe	28
PID 2248 wrote to memory of 2236	2248	rundll32.exe	28
PID 2248 wrote to memory of 2236	2248	rundll32.exe	28
PID 2248 wrote to memory of 2236	2248	rundll32.exe	28
PID 2248 wrote to memory of 2236	2248	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01e6259a8d8217db4f7387f5b596b4a3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01e6259a8d8217db4f7387f5b596b4a3_JaffaCakes118.dll,#1
  2⤵
  PID:2236

memory/2236-0-0x0000000067400000-0x0000000067474000-memory.dmp

Filesize
464KB

Download
memory/2236-1-0x0000000067400000-0x0000000067474000-memory.dmp

Filesize
464KB

Download