3959032e90a3c48a5e00a0e3b0167d437aee059256edf56dae19b147721f29bd

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 11:49

Target

0df484c2a872000762ca6e010ca65af3_JaffaCakes118.dll
Size

564KB
MD5

0df484c2a872000762ca6e010ca65af3
SHA1

cbbe63b74478dab2b3bda26b7444b2914bd2df8d
SHA256

3959032e90a3c48a5e00a0e3b0167d437aee059256edf56dae19b147721f29bd
SHA512

a5ac3aef5b80d0d2d0a57096beb07bb8ae2ab520775b49027ff2d851f86c867034437a047c9adc877a4eea48cbf0afd6ea4ec8320d94b9dbc20ecadce325fc86
SSDEEP

12288:rlcRBG9XUAKSg1Umgw8hCgXespnEM87b2uOD/vACz1+7o7Bq:0GzKvkwECgXh9EdOTL1V7B

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3024	3012	rundll32.exe	28
PID 3012 wrote to memory of 3024	3012	rundll32.exe	28
PID 3012 wrote to memory of 3024	3012	rundll32.exe	28
PID 3012 wrote to memory of 3024	3012	rundll32.exe	28
PID 3012 wrote to memory of 3024	3012	rundll32.exe	28
PID 3012 wrote to memory of 3024	3012	rundll32.exe	28
PID 3012 wrote to memory of 3024	3012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0df484c2a872000762ca6e010ca65af3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0df484c2a872000762ca6e010ca65af3_JaffaCakes118.dll,#1
  2⤵
  PID:3024

memory/3024-0-0x00000000004C0000-0x0000000000542000-memory.dmp

Filesize
520KB

Download