590c5874b3a79f795760b051025c537b37f03ac2de86f183dd10cd9bed71736f

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 16:04

Target

078f8a5e191e6aec217fa6f58c675d2a_JaffaCakes118.dll
Size

526KB
MD5

078f8a5e191e6aec217fa6f58c675d2a
SHA1

553f8000d819dcaf596bb7ca69bf55e29b6027e4
SHA256

590c5874b3a79f795760b051025c537b37f03ac2de86f183dd10cd9bed71736f
SHA512

3e11aac1fa0017148eceed62a610443c222d6fc3cce78fc368bca9bf24f1dbfd95337700a8f3441b69dbac5852a6ec2fcf30acf8dc8066c5ea19c6cf8a4421c6
SSDEEP

12288:IJFtyyPBEmdnAGmJ9dFsztFnSa2cTNgwI:I71EaXmFF+FnSBcTS3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28
PID 1520 wrote to memory of 1924	1520	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\078f8a5e191e6aec217fa6f58c675d2a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\078f8a5e191e6aec217fa6f58c675d2a_JaffaCakes118.dll,#1
  2⤵
  PID:1924

memory/1924-0-0x00000000001B0000-0x000000000023B000-memory.dmp

Filesize
556KB

Download