5ee2449c98098531075fc8cc76fe25fefd8127f35083d1af6f60c656a09f94d9

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 04:44

Target

211c971a64a50ff00e6c5086d9e63edf_JaffaCakes118.dll
Size

9KB
MD5

211c971a64a50ff00e6c5086d9e63edf
SHA1

10598062bfd14c3d82ff6ca64c2cdb74fee96b06
SHA256

5ee2449c98098531075fc8cc76fe25fefd8127f35083d1af6f60c656a09f94d9
SHA512

95167e06cf805bfdbbf48408393da274eacc720e5a178aeecc53115fb6a2ee12de8952487663496e740b25486cbee965ba0a9933c5621914968a19c16fb73636
SSDEEP

96:q1V7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG34bFw:kuwEt8rsTUtPLzKNWSYWF4bFw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2864	2088	rundll32.exe	28
PID 2088 wrote to memory of 2864	2088	rundll32.exe	28
PID 2088 wrote to memory of 2864	2088	rundll32.exe	28
PID 2088 wrote to memory of 2864	2088	rundll32.exe	28
PID 2088 wrote to memory of 2864	2088	rundll32.exe	28
PID 2088 wrote to memory of 2864	2088	rundll32.exe	28
PID 2088 wrote to memory of 2864	2088	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\211c971a64a50ff00e6c5086d9e63edf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\211c971a64a50ff00e6c5086d9e63edf_JaffaCakes118.dll,#1
  2⤵
  PID:2864

memory/2864-1-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/2864-0-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/2864-2-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download