f31b950cddeedb9120a5a98d4b3cd3a5a35818048b310bbf9a54a23732055133

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 08:39

Target

04698902faaa9fc25f25924648dd69b8_JaffaCakes118.dll
Size

58KB
MD5

04698902faaa9fc25f25924648dd69b8
SHA1

2cf5dc3d1c56788c352e437e6b846868e154c4c2
SHA256

f31b950cddeedb9120a5a98d4b3cd3a5a35818048b310bbf9a54a23732055133
SHA512

3a815cfe69caa030cacf248bfb8aac84c62b543986de2e1bb485f9dc97bc403cd0019f405200b738c5f2de857665a8b3881e799ae82270a74f0dfe8b0b47359a
SSDEEP

1536:F7hligalhWrS5jyDoIWKfycLRccbWEt09Zfad8XV:Fd/af7I5gK0nXV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 352 wrote to memory of 2452	352	rundll32.exe	28
PID 352 wrote to memory of 2452	352	rundll32.exe	28
PID 352 wrote to memory of 2452	352	rundll32.exe	28
PID 352 wrote to memory of 2452	352	rundll32.exe	28
PID 352 wrote to memory of 2452	352	rundll32.exe	28
PID 352 wrote to memory of 2452	352	rundll32.exe	28
PID 352 wrote to memory of 2452	352	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04698902faaa9fc25f25924648dd69b8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04698902faaa9fc25f25924648dd69b8_JaffaCakes118.dll,#1
  2⤵
  PID:2452

memory/2452-0-0x0000000000650000-0x00000000006A0000-memory.dmp

Filesize
320KB

Download