829dad515d4304be0198e207f3143f875a06c81d9302f10d432530c2308344ec

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 00:41

Target

1827de680f27186c9cf27bcd613f9b8b_JaffaCakes118.dll
Size

6KB
MD5

1827de680f27186c9cf27bcd613f9b8b
SHA1

5562a6975f72bce2840c804699023240837b2cc0
SHA256

829dad515d4304be0198e207f3143f875a06c81d9302f10d432530c2308344ec
SHA512

3dbe1cb81dc205e887e206e031c05e44d4014114a2691246deccfc2b6cf794b785ae0ab0eb7b462e0caec03c588f5ea6c082b00ae7042af020d1b1d233648ebe
SSDEEP

48:aGy7MN4cpSGAXbIni1kvNs6ztutiKIZWiwQTnU5WwG2QozbC:xB4c4G6bn1k1sw0EW3enIWwGqb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2500	2184	rundll32.exe	28
PID 2184 wrote to memory of 2500	2184	rundll32.exe	28
PID 2184 wrote to memory of 2500	2184	rundll32.exe	28
PID 2184 wrote to memory of 2500	2184	rundll32.exe	28
PID 2184 wrote to memory of 2500	2184	rundll32.exe	28
PID 2184 wrote to memory of 2500	2184	rundll32.exe	28
PID 2184 wrote to memory of 2500	2184	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1827de680f27186c9cf27bcd613f9b8b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1827de680f27186c9cf27bcd613f9b8b_JaffaCakes118.dll,#1
  2⤵
  PID:2500

memory/2500-0-0x0000000000160000-0x0000000000166000-memory.dmp

Filesize
24KB

Download