77bb76f098a5705077825a69eef3989be59f02af3edc01a7216f2644b4601ab8

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 18:49

Target

08cccb432fd8322bb1f565dd421d1243_JaffaCakes118.dll
Size

94KB
MD5

08cccb432fd8322bb1f565dd421d1243
SHA1

bf91220a35911e153838107abfe6b7dd1236c756
SHA256

77bb76f098a5705077825a69eef3989be59f02af3edc01a7216f2644b4601ab8
SHA512

403c18449973de33352ea14b67adbc86f3e72ddca3dec56b31a2046eb30b1243937b5a63648c2d25935efaa362c6c6fe4551730157223d946102d53d4fcd60b4
SSDEEP

1536:NZLt29OJY30k+JhJU5aSCQFbyJKR76sGa1bV:bLt20k+ZOb0Kt6sGkb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2932	2968	rundll32.exe	28
PID 2968 wrote to memory of 2932	2968	rundll32.exe	28
PID 2968 wrote to memory of 2932	2968	rundll32.exe	28
PID 2968 wrote to memory of 2932	2968	rundll32.exe	28
PID 2968 wrote to memory of 2932	2968	rundll32.exe	28
PID 2968 wrote to memory of 2932	2968	rundll32.exe	28
PID 2968 wrote to memory of 2932	2968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08cccb432fd8322bb1f565dd421d1243_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\08cccb432fd8322bb1f565dd421d1243_JaffaCakes118.dll,#1
  2⤵
  PID:2932

memory/2932-0-0x0000000031000000-0x000000003101D000-memory.dmp

Filesize
116KB

Download