3e141afd5e3adc24ea2515c4fa92b0ad80db9bd91ed8970de703790ff0d3512c

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 18:32

Target

235897b51f416edd1df31ec358a17de1_JaffaCakes118.dll
Size

96KB
MD5

235897b51f416edd1df31ec358a17de1
SHA1

56fcfc792840e637004b9bdd702fa8c64d47298b
SHA256

3e141afd5e3adc24ea2515c4fa92b0ad80db9bd91ed8970de703790ff0d3512c
SHA512

a03a7c8608cb4f8917378aa7b24070fdb5c516b894ad1ba466394d9abcac546fe7a2dedca7f0ce1119f9b8b210ef5ae94392aa7b8f41bcf41839f75db27a86e7
SSDEEP

1536:kOuaLOnTIQTiOobuM035xW2Tb4goNFKrGK9+BVHWU2F1AZm:eaLHQfTd35xV8gtUZZm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1176	2740	rundll32.exe	28
PID 2740 wrote to memory of 1176	2740	rundll32.exe	28
PID 2740 wrote to memory of 1176	2740	rundll32.exe	28
PID 2740 wrote to memory of 1176	2740	rundll32.exe	28
PID 2740 wrote to memory of 1176	2740	rundll32.exe	28
PID 2740 wrote to memory of 1176	2740	rundll32.exe	28
PID 2740 wrote to memory of 1176	2740	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\235897b51f416edd1df31ec358a17de1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\235897b51f416edd1df31ec358a17de1_JaffaCakes118.dll,#1
  2⤵
  PID:1176

memory/1176-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download