8eb0568a33734ba1551ed45e23e50fe4e188120c4d8136e58ce2837e6190ad12

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 18:40

Target

235eed9d56899fd29d7ef265b3a527ca_JaffaCakes118.dll
Size

244KB
MD5

235eed9d56899fd29d7ef265b3a527ca
SHA1

b2d1e21ea60d3f9fb0e5947fdb8f7d662fa96cc1
SHA256

8eb0568a33734ba1551ed45e23e50fe4e188120c4d8136e58ce2837e6190ad12
SHA512

c432f1f69a090a189d336e11cf6a140297082f0de37efbf5345465f144ba9dbe0c1091c092aa4b318ff6f32d9543ae1098d2e6f7a01c53ccff57512c360d30c7
SSDEEP

6144:SnlBp/5tLyHj0Ut2/yIGMeolszuVkPkiO6hMOvC:6lBHgxUyKeo2qVgOeMOvC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1960	2392	rundll32.exe	28
PID 2392 wrote to memory of 1960	2392	rundll32.exe	28
PID 2392 wrote to memory of 1960	2392	rundll32.exe	28
PID 2392 wrote to memory of 1960	2392	rundll32.exe	28
PID 2392 wrote to memory of 1960	2392	rundll32.exe	28
PID 2392 wrote to memory of 1960	2392	rundll32.exe	28
PID 2392 wrote to memory of 1960	2392	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\235eed9d56899fd29d7ef265b3a527ca_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\235eed9d56899fd29d7ef265b3a527ca_JaffaCakes118.dll,#1
  2⤵
  PID:1960

memory/1960-2-0x00000000001B0000-0x00000000001EB000-memory.dmp

Filesize
236KB

Download
memory/1960-1-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download
memory/1960-0-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download