93321e887737d346b5a86b83879e58cd936edb1404a2663cf9f19c5824cfe1f0

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 08:57

Target

19889531bd1c189fb2ad153e4cf06399_JaffaCakes118.dll
Size

101KB
MD5

19889531bd1c189fb2ad153e4cf06399
SHA1

5f5efebe4bf3c646f215b6cc826e31bdbc0d5342
SHA256

93321e887737d346b5a86b83879e58cd936edb1404a2663cf9f19c5824cfe1f0
SHA512

f86abb7eed19e410de6c7f6518ef6973413c3229d088b5bf55e722a7b776e73991bd50ac4b07536e22f693659ba416a2732d7e2c1c667fea4fbb4b6410f2a427
SSDEEP

3072:jZt152B69VNAdQKHCPY5p/68ao4ssZHmOBQmT1hZWkA:Ft152B6RZKiA5slo4xm4JZWkA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 3032	2424	rundll32.exe	28
PID 2424 wrote to memory of 3032	2424	rundll32.exe	28
PID 2424 wrote to memory of 3032	2424	rundll32.exe	28
PID 2424 wrote to memory of 3032	2424	rundll32.exe	28
PID 2424 wrote to memory of 3032	2424	rundll32.exe	28
PID 2424 wrote to memory of 3032	2424	rundll32.exe	28
PID 2424 wrote to memory of 3032	2424	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\19889531bd1c189fb2ad153e4cf06399_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\19889531bd1c189fb2ad153e4cf06399_JaffaCakes118.dll,#1
  2⤵
  PID:3032

memory/3032-0-0x000000001C200000-0x000000001C2CF000-memory.dmp

Filesize
828KB

Download
memory/3032-1-0x000000001C200000-0x000000001C2CF000-memory.dmp

Filesize
828KB

Download
memory/3032-2-0x000000001C200000-0x000000001C2CF000-memory.dmp

Filesize
828KB

Download