7fa3c6cdd9adc510cbebd4f02e52a29dd70b02eb291a680c859147bbd266cca5

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 20:59

Target

1c7a40dfb710269866d3ae953cbb8729_JaffaCakes118.dll
Size

51KB
MD5

1c7a40dfb710269866d3ae953cbb8729
SHA1

e8e6c854d921bec2708fbed334b1d2073449533d
SHA256

7fa3c6cdd9adc510cbebd4f02e52a29dd70b02eb291a680c859147bbd266cca5
SHA512

f1daadd297b91c0c7222dc3b8dcff11e73ca4624638137041337e6cf34001f275ed0e06dafa8549b97571b7e68989bd214596610a7e545c55f3c13b8f89fdceb
SSDEEP

768:k4I+2CNsWE3T+qF8MlY5dmHfZ4kaPbuq2S/jNa:k4IrkE3TZB0duqb/j

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1464	1712	rundll32.exe	28
PID 1712 wrote to memory of 1464	1712	rundll32.exe	28
PID 1712 wrote to memory of 1464	1712	rundll32.exe	28
PID 1712 wrote to memory of 1464	1712	rundll32.exe	28
PID 1712 wrote to memory of 1464	1712	rundll32.exe	28
PID 1712 wrote to memory of 1464	1712	rundll32.exe	28
PID 1712 wrote to memory of 1464	1712	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c7a40dfb710269866d3ae953cbb8729_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c7a40dfb710269866d3ae953cbb8729_JaffaCakes118.dll,#1
  2⤵
  PID:1464

memory/1464-0-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download