592ffa6c87feca17666bbfbb80dd91313332f20df3377f91dc97715298d8b26e

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 23:39

Target

23e05c457870587a27fb2f58393fa17d_JaffaCakes118.dll
Size

152KB
MD5

23e05c457870587a27fb2f58393fa17d
SHA1

bcff03d1ba8272aba1bd73fb41cd8e4873f5cb8d
SHA256

592ffa6c87feca17666bbfbb80dd91313332f20df3377f91dc97715298d8b26e
SHA512

7c39260bb9dbe5ea2997ddfc66787a9f8968068a737f77eb3a5ded5508c8fb8459318457491746cee9855c0c36de83234e7172822d1aa587d56d85c05fd991e4
SSDEEP

3072:p7UgfjBDBUm4JD9oqe5/HbkL6Ho6Pfi7ZR5Ex32669cm0y2N9:DB6Fe5PbkL+Pfi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2156	2212	rundll32.exe	28
PID 2212 wrote to memory of 2156	2212	rundll32.exe	28
PID 2212 wrote to memory of 2156	2212	rundll32.exe	28
PID 2212 wrote to memory of 2156	2212	rundll32.exe	28
PID 2212 wrote to memory of 2156	2212	rundll32.exe	28
PID 2212 wrote to memory of 2156	2212	rundll32.exe	28
PID 2212 wrote to memory of 2156	2212	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23e05c457870587a27fb2f58393fa17d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23e05c457870587a27fb2f58393fa17d_JaffaCakes118.dll,#1
  2⤵
  PID:2156

memory/2156-5-0x000000001000E000-0x0000000010022000-memory.dmp

Filesize
80KB

Download
memory/2156-4-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download
memory/2156-0-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download
memory/2156-6-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download