3734d76f7438d1809e1e078475e4206ee65ebe0fd4ef64514afb77ec23d8b003

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 09:01

Target

048a2d8f14b32c63019e812c34ee48ee_JaffaCakes118.dll
Size

2.0MB
MD5

048a2d8f14b32c63019e812c34ee48ee
SHA1

7ba1797a0028227c398d226b085d77b9e745d56e
SHA256

3734d76f7438d1809e1e078475e4206ee65ebe0fd4ef64514afb77ec23d8b003
SHA512

c2eb75f035ffbd670ee3619d1df4bb56c408b2d20fc321f7df2dc40518dfa8b5e4eeb66188bb81838cf94999e6ac3d465e89fc1588a19649d6748964362d80ee
SSDEEP

49152:HlCGeQCAqXoZWHHAz+Sx+WysjwCgOJ/j/nA8smT47+7FiB+0:HlCVQ42+SMWNxJ7/nATC4K7X0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2192	1728	rundll32.exe	28
PID 1728 wrote to memory of 2192	1728	rundll32.exe	28
PID 1728 wrote to memory of 2192	1728	rundll32.exe	28
PID 1728 wrote to memory of 2192	1728	rundll32.exe	28
PID 1728 wrote to memory of 2192	1728	rundll32.exe	28
PID 1728 wrote to memory of 2192	1728	rundll32.exe	28
PID 1728 wrote to memory of 2192	1728	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\048a2d8f14b32c63019e812c34ee48ee_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\048a2d8f14b32c63019e812c34ee48ee_JaffaCakes118.dll,#1
  2⤵
  PID:2192

memory/2192-0-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download