5a20bffafe8ddf121bbb49d17f0eec58cd68c2faade44b0698146493c9f6a55a

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 10:35

Target

1af7c51c902cd0c05907e83851cf2ab6_JaffaCakes118.dll
Size

36KB
MD5

1af7c51c902cd0c05907e83851cf2ab6
SHA1

4c68953fe1734b62da3040bd1f962c17456cc7ff
SHA256

5a20bffafe8ddf121bbb49d17f0eec58cd68c2faade44b0698146493c9f6a55a
SHA512

bc36018d846d5abf23755b236f9d3102045a5a2644fc178ee01e1382e77013931416db4847b597f047cb411917fdc342e69e256f85fa957aafa829eb1e580595
SSDEEP

768:0F8EQ4kt1ohfNqsDiyL8C6KnogxJzFlWJ:0F8Ekt1oSsDiyLr6SHzrW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1af7c51c902cd0c05907e83851cf2ab6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1af7c51c902cd0c05907e83851cf2ab6_JaffaCakes118.dll,#1
  2⤵
  PID:1592

memory/1592-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download