094334cc79a798b6c7976e494186c572b04b1507989e3228b274982e76ee8b17

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 11:59

Target

05ca562df84451922ed44e2f3ae94a34_JaffaCakes118.dll
Size

8KB
MD5

05ca562df84451922ed44e2f3ae94a34
SHA1

8eefb360df997dacd91cb4b8a23227caa2e7d55e
SHA256

094334cc79a798b6c7976e494186c572b04b1507989e3228b274982e76ee8b17
SHA512

308a6fcb662e5e6cc3e5e59fcd542a0c0def52d5275174d662fee35660d05201e97796424eb63a9e1efc7dbc48e6ee511a2067b07a1dfd531b8761def129e1fb
SSDEEP

192:VUFK5OJ+J3J22koZ7F3FYqtOgdn7SmPdk0czumuelnkZS:aGOwJ3jXR3FPtVlPMumu23

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2196	2180	rundll32.exe	28
PID 2180 wrote to memory of 2196	2180	rundll32.exe	28
PID 2180 wrote to memory of 2196	2180	rundll32.exe	28
PID 2180 wrote to memory of 2196	2180	rundll32.exe	28
PID 2180 wrote to memory of 2196	2180	rundll32.exe	28
PID 2180 wrote to memory of 2196	2180	rundll32.exe	28
PID 2180 wrote to memory of 2196	2180	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05ca562df84451922ed44e2f3ae94a34_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05ca562df84451922ed44e2f3ae94a34_JaffaCakes118.dll,#1
  2⤵
  PID:2196

memory/2196-0-0x0000000010000000-0x0000000010004000-memory.dmp

Filesize
16KB

Download
memory/2196-1-0x0000000010001000-0x0000000010002000-memory.dmp

Filesize
4KB

Download