e5d80681b5d5df92c37cd592a1f93df721d1555da13814d4ec5281e5d29cf914

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 15:45

Target

076b25ce5dae146bc7306f48b6945f11_JaffaCakes118.dll
Size

45KB
MD5

076b25ce5dae146bc7306f48b6945f11
SHA1

bedaf67a5d40d6c02c1a8563bc33a27f85186722
SHA256

e5d80681b5d5df92c37cd592a1f93df721d1555da13814d4ec5281e5d29cf914
SHA512

11ca07d1cd4f3805d750b2e1c06e3d5bf962373c49ea4cdf6daf7d64ab8b5fc0e6abf28ce18d1ca552ef164c891828232aaa5a4ac26b324e13349a7ad4c3743f
SSDEEP

768:a2b9zhFSscyS/uhDg1akZUXVxfNa3AxQXo9fal:aw9jSszRMtmF9Dx4o8l

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 848	2188	rundll32.exe	28
PID 2188 wrote to memory of 848	2188	rundll32.exe	28
PID 2188 wrote to memory of 848	2188	rundll32.exe	28
PID 2188 wrote to memory of 848	2188	rundll32.exe	28
PID 2188 wrote to memory of 848	2188	rundll32.exe	28
PID 2188 wrote to memory of 848	2188	rundll32.exe	28
PID 2188 wrote to memory of 848	2188	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\076b25ce5dae146bc7306f48b6945f11_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\076b25ce5dae146bc7306f48b6945f11_JaffaCakes118.dll,#1
  2⤵
  PID:848

memory/848-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download