b450b755594ee012b2f02ae02af181d68f3481896fb8a865335f655a67845dda

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 18:18

Target

0894189694f6df92d4808cebcaad8a7b_JaffaCakes118.dll
Size

21KB
MD5

0894189694f6df92d4808cebcaad8a7b
SHA1

964655d5bc94dd53ab9c0781754ea0385c69b410
SHA256

b450b755594ee012b2f02ae02af181d68f3481896fb8a865335f655a67845dda
SHA512

37b0583f8179b39a06c58838d4bbb691e0c524fd5229d15d390d779d94101ea10ebd61d6482e02a3d354a8230ad86cf74e103ee97e1d01644fcc3fa926041297
SSDEEP

384:kMRdCy/MqlWL6mQe+Qmdd7FspGyPbqoq4VMrAzdbJ:vCy0qls6mQhT/mpRfVlp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 552	2944	rundll32.exe	28
PID 2944 wrote to memory of 552	2944	rundll32.exe	28
PID 2944 wrote to memory of 552	2944	rundll32.exe	28
PID 2944 wrote to memory of 552	2944	rundll32.exe	28
PID 2944 wrote to memory of 552	2944	rundll32.exe	28
PID 2944 wrote to memory of 552	2944	rundll32.exe	28
PID 2944 wrote to memory of 552	2944	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0894189694f6df92d4808cebcaad8a7b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0894189694f6df92d4808cebcaad8a7b_JaffaCakes118.dll,#1
  2⤵
  PID:552

memory/552-0-0x0000000000170000-0x000000000017B000-memory.dmp

Filesize
44KB

Download