c2cf6cc50b902e47c15557b0857b847fbad5fda7a496c635fab96fee0f8763eb

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 12:05

Target

2257115d04cd62cf5a17204c785308ef_JaffaCakes118.dll
Size

101KB
MD5

2257115d04cd62cf5a17204c785308ef
SHA1

d13aab55fb7d65428d515317787aecc84a7c50b3
SHA256

c2cf6cc50b902e47c15557b0857b847fbad5fda7a496c635fab96fee0f8763eb
SHA512

51e298904e3835d2e692a528cceeaf0f832b8d4f6be271984f499bb9d83bd8e97de63cc62ffe715d9bd09c7d9ad09db7213a9df74e296de5df35b3c751d61d0d
SSDEEP

1536:Xrj2DTisS3kalQA86RIgOSqB+ftXpKEZI0+T24G3/SuIeazvPfrwILCjorOTr:v2DTv1alQ8IgOZ+ftV+T2ZKbPfBLioC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2072	2164	rundll32.exe	28
PID 2164 wrote to memory of 2072	2164	rundll32.exe	28
PID 2164 wrote to memory of 2072	2164	rundll32.exe	28
PID 2164 wrote to memory of 2072	2164	rundll32.exe	28
PID 2164 wrote to memory of 2072	2164	rundll32.exe	28
PID 2164 wrote to memory of 2072	2164	rundll32.exe	28
PID 2164 wrote to memory of 2072	2164	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2257115d04cd62cf5a17204c785308ef_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2257115d04cd62cf5a17204c785308ef_JaffaCakes118.dll,#1
  2⤵
  PID:2072

memory/2072-3-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2072-2-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2072-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2072-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download