e16afe0d4e655437255e9113647a14bd71a32a8269e106232cfd740f7faaa2ed

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 22:18

Target

17bbce138cf483552d80d5173ab3abf6_JaffaCakes118.dll
Size

24KB
MD5

17bbce138cf483552d80d5173ab3abf6
SHA1

dbba94d291839a7aeaca14be7de594a457eb2041
SHA256

e16afe0d4e655437255e9113647a14bd71a32a8269e106232cfd740f7faaa2ed
SHA512

7d28b28c3ebd15d732f83d2ed15f66b30b5121ced24bbb563417e8b2d5eade046228e2aa441886f4a132e215c5035680cd823d65d190d1ac198ae350050902c1
SSDEEP

384:VW4JURRkGRW89KCPMO3hz6vAyeQfV10XXThrIZcKbwOR0q6Sg/uASCX8:VdU9Rx2Ay5V1W5IZFb9ReduVf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17bbce138cf483552d80d5173ab3abf6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17bbce138cf483552d80d5173ab3abf6_JaffaCakes118.dll,#1
  2⤵
  PID:2884

memory/2884-0-0x0000000000230000-0x0000000000235000-memory.dmp

Filesize
20KB

Download
memory/2884-1-0x0000000010010000-0x0000000010011000-memory.dmp

Filesize
4KB

Download
memory/2884-2-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download