53242315e4df0ffc0de099ca12383e5594c3ea7cf4db77b626202bd29e234f30

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 05:52

Target

1905744fe7c46f22aef2bb6c25a70aba_JaffaCakes118.dll
Size

31KB
MD5

1905744fe7c46f22aef2bb6c25a70aba
SHA1

050438614c49ba98eeab2a2583c0d72c8d11128a
SHA256

53242315e4df0ffc0de099ca12383e5594c3ea7cf4db77b626202bd29e234f30
SHA512

b17b8619cc19060d9819e6b1a9e6ebebf4c29a66ee23a7d37e0adaab98954684e7dfef670dbcfa7bc94fe4bd43398e7c5080407ee260c6fbeebe79e450dbd562
SSDEEP

768:zYywROEtjoa6TAIDVYdWpzuHeGcRKk6Y1DHUJqxQS:zgEEtF6/wWpzuHDcokX1TUUH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2168	1656	rundll32.exe	28
PID 1656 wrote to memory of 2168	1656	rundll32.exe	28
PID 1656 wrote to memory of 2168	1656	rundll32.exe	28
PID 1656 wrote to memory of 2168	1656	rundll32.exe	28
PID 1656 wrote to memory of 2168	1656	rundll32.exe	28
PID 1656 wrote to memory of 2168	1656	rundll32.exe	28
PID 1656 wrote to memory of 2168	1656	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1905744fe7c46f22aef2bb6c25a70aba_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1905744fe7c46f22aef2bb6c25a70aba_JaffaCakes118.dll,#1
  2⤵
  PID:2168

memory/2168-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download