372b9d26d52c5f28e75932bf2e946d1538bfe329669decbaf6e41fc641503dd3

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 05:54

Target

214c6f56bbf788edcf47d2f9e2074717_JaffaCakes118.dll
Size

257KB
MD5

214c6f56bbf788edcf47d2f9e2074717
SHA1

1c9a51c064828ed6fa75c236d6bd9535d7e36f28
SHA256

372b9d26d52c5f28e75932bf2e946d1538bfe329669decbaf6e41fc641503dd3
SHA512

5d9dae9ac06f0afe23691bf16c6fe4f4822188ee3b1fec3875e7bc99e4b709f0d42e997a5fa4b14cc6f7e877e3878459f28b8b710d181d4fa04f6fe916813e62
SSDEEP

6144:9I3I1UeQLBvl+2VRr+wxp4XxlOjhzpHqpaI8oDHGgAVmtRF:X1UvLr+dmp4Xx4tz9qpFrD52mt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\214c6f56bbf788edcf47d2f9e2074717_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\214c6f56bbf788edcf47d2f9e2074717_JaffaCakes118.dll,#1
  2⤵
  PID:2924

memory/2924-0-0x0000000000960000-0x00000000009A0000-memory.dmp

Filesize
256KB

Download
memory/2924-1-0x00000000743AE000-0x00000000743AF000-memory.dmp

Filesize
4KB

Download
memory/2924-2-0x0000000002280000-0x00000000022C8000-memory.dmp

Filesize
288KB

Download
memory/2924-3-0x0000000074C20000-0x0000000074C68000-memory.dmp

Filesize
288KB

Download