f33678661926e8401df706d3cc4b32ba35308c498fb6b8be2c80cfa077938556

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 21:42

Target

0ac1213ac9d2fc2a3273aa151d052769_JaffaCakes118.dll
Size

49KB
MD5

0ac1213ac9d2fc2a3273aa151d052769
SHA1

cf21d3db484877e14ec0f699271db9da31cef04c
SHA256

f33678661926e8401df706d3cc4b32ba35308c498fb6b8be2c80cfa077938556
SHA512

688fea83cb081712138a3d51d22a2880fcf4069c99236cc7f63b51498394ce17cf52f36f13b811aef8b46ea6ca0b8acd4f9413f9399b6b2ac23543407068291f
SSDEEP

768:A1/ewflZCucMM7FB87ZroWL/PlJQTDbuhrAu+ZShWIUGIYn2r5U5Ds:0uwzL1ynS5gZShWIhHn2YDs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3000	2992	rundll32.exe	28
PID 2992 wrote to memory of 3000	2992	rundll32.exe	28
PID 2992 wrote to memory of 3000	2992	rundll32.exe	28
PID 2992 wrote to memory of 3000	2992	rundll32.exe	28
PID 2992 wrote to memory of 3000	2992	rundll32.exe	28
PID 2992 wrote to memory of 3000	2992	rundll32.exe	28
PID 2992 wrote to memory of 3000	2992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ac1213ac9d2fc2a3273aa151d052769_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ac1213ac9d2fc2a3273aa151d052769_JaffaCakes118.dll,#1
  2⤵
  PID:3000

memory/3000-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download