27130a41d3e9cdfada35b1356f30bdc83b0204aecab12103d0749beb7fc3b80b

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 18:14

Target

0a10b324f8da4a1abca662365f9d2e31_JaffaCakes118.dll
Size

505KB
MD5

0a10b324f8da4a1abca662365f9d2e31
SHA1

714b0c13652d11ef0d1826c3b01dccd34256da2e
SHA256

27130a41d3e9cdfada35b1356f30bdc83b0204aecab12103d0749beb7fc3b80b
SHA512

c22c7f1961b5fa05d0f2442fadd77104f9b471df922fc8d786aaf07a42cfee233da6aba14e6a8f4a36a6b90bd795eb040b78bc144072c39b1eb1b537f574d827
SSDEEP

12288:G9IfTWoSk8d1ABmEmjnli9AvnMpbuJtKX5e:GifnSkaAB9wLAyTKpe

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2980	2976	rundll32.exe	28
PID 2976 wrote to memory of 2980	2976	rundll32.exe	28
PID 2976 wrote to memory of 2980	2976	rundll32.exe	28
PID 2976 wrote to memory of 2980	2976	rundll32.exe	28
PID 2976 wrote to memory of 2980	2976	rundll32.exe	28
PID 2976 wrote to memory of 2980	2976	rundll32.exe	28
PID 2976 wrote to memory of 2980	2976	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a10b324f8da4a1abca662365f9d2e31_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a10b324f8da4a1abca662365f9d2e31_JaffaCakes118.dll,#1
  2⤵
  PID:2980

memory/2980-0-0x000000004DE20000-0x000000004DE9F000-memory.dmp

Filesize
508KB

Download
memory/2980-1-0x000000004DE20000-0x000000004DE9F000-memory.dmp

Filesize
508KB

Download