9435d432c1a22b09700abf6f9f1e58285bbba054e085e151360bdd0da0476010

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 22:39

Target

267d7c0de27396dc3009a0cdab99824f_JaffaCakes118.dll
Size

43KB
MD5

267d7c0de27396dc3009a0cdab99824f
SHA1

6fe2ad5d82a592d576e2f99c52e6fd72b6c59aca
SHA256

9435d432c1a22b09700abf6f9f1e58285bbba054e085e151360bdd0da0476010
SHA512

88af8b047f3b954d3c00af88cc9d95d08ef92fcc7f56c2ed646f186efc64bfca37abcba0664de2402aef722bec786065bd27fbb92cf34872a9087f17b9da49a7
SSDEEP

768:8czzm2poIScVTWY6c7SoNv9B35AfvsqNI6L+PShJxHnVZuF6uUeVBx5gH6SLxhhn:rVsYb753C8qNNL+POJ/UFUB6ShQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2452	1984	rundll32.exe	31
PID 1984 wrote to memory of 2452	1984	rundll32.exe	31
PID 1984 wrote to memory of 2452	1984	rundll32.exe	31
PID 1984 wrote to memory of 2452	1984	rundll32.exe	31
PID 1984 wrote to memory of 2452	1984	rundll32.exe	31
PID 1984 wrote to memory of 2452	1984	rundll32.exe	31
PID 1984 wrote to memory of 2452	1984	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\267d7c0de27396dc3009a0cdab99824f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\267d7c0de27396dc3009a0cdab99824f_JaffaCakes118.dll,#1
  2⤵
  PID:2452

memory/2452-0-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download