efc7e49de1cda1c942ff301ddcf7fcf08723d4afec31dee730fa7f45d570efee

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 09:02

Target

1ab2a403e378c586ae47d4a1ac96fafb_JaffaCakes118.dll
Size

78KB
MD5

1ab2a403e378c586ae47d4a1ac96fafb
SHA1

1bdd95c32415b97ef29cadc1f3befecee1fb0e87
SHA256

efc7e49de1cda1c942ff301ddcf7fcf08723d4afec31dee730fa7f45d570efee
SHA512

92e38dcb53d3b1a4471d8c6124562f5fb925d059085210ed56e95796f4cbb19749791d2fdf1bd4cbf21dfd071ae241d83813a3655460a0562074027ad1a53622
SSDEEP

1536:lXuRrlGl+slHQLtXFNcASa8fO/TrnJ77jLsezjGdwfk0iH:8lotlHQDZ82/h7/s0GqM0I

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1720	2400	rundll32.exe	28
PID 2400 wrote to memory of 1720	2400	rundll32.exe	28
PID 2400 wrote to memory of 1720	2400	rundll32.exe	28
PID 2400 wrote to memory of 1720	2400	rundll32.exe	28
PID 2400 wrote to memory of 1720	2400	rundll32.exe	28
PID 2400 wrote to memory of 1720	2400	rundll32.exe	28
PID 2400 wrote to memory of 1720	2400	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ab2a403e378c586ae47d4a1ac96fafb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ab2a403e378c586ae47d4a1ac96fafb_JaffaCakes118.dll,#1
  2⤵
  PID:1720

memory/1720-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download