b4273442fc7efc7e9230f996aabfb26115d2a56855e295d26877b942be9e6dbf

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 03:57

Target

18b218e70f9dbc4b42163eca79b8574d_JaffaCakes118.dll
Size

119KB
MD5

18b218e70f9dbc4b42163eca79b8574d
SHA1

974270c0d604101c4ad08ac2fd1bdd4e3367305e
SHA256

b4273442fc7efc7e9230f996aabfb26115d2a56855e295d26877b942be9e6dbf
SHA512

57da0fbea1be61382a7b09bf53a6cb71d00fc7849cd1697c0c2aef4fcd7367b0ac18074e1af726398792d431218803b3419e0ff08a1b789db93fb4b75d9d706c
SSDEEP

3072:ypBPMjcUv/VJgXBp7x5BME2DFxj75ARes66EA/Y:yzPM7v/VUtxc/v5Xpk/Y

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2052	2112	rundll32.exe	28
PID 2112 wrote to memory of 2052	2112	rundll32.exe	28
PID 2112 wrote to memory of 2052	2112	rundll32.exe	28
PID 2112 wrote to memory of 2052	2112	rundll32.exe	28
PID 2112 wrote to memory of 2052	2112	rundll32.exe	28
PID 2112 wrote to memory of 2052	2112	rundll32.exe	28
PID 2112 wrote to memory of 2052	2112	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\18b218e70f9dbc4b42163eca79b8574d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\18b218e70f9dbc4b42163eca79b8574d_JaffaCakes118.dll,#1
  2⤵
  PID:2052

memory/2052-1-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download
memory/2052-2-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download
memory/2052-0-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download