814bc98bc29bad727b6579437731a1bcd0874085345b36f4e0fc60c061c2b2e0

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 00:24

Target

23ffb792a8544b366bd69d9b3b23cce2_JaffaCakes118.dll
Size

13KB
MD5

23ffb792a8544b366bd69d9b3b23cce2
SHA1

0640ca53d1660ffdaeb8069db7cb0462b39d521f
SHA256

814bc98bc29bad727b6579437731a1bcd0874085345b36f4e0fc60c061c2b2e0
SHA512

c99afd2d31546d9f465df536482482dcb65aedbe7fac3f418427a5178778aad81df3886d25a5eed58d58df2735e3daace4c7e7b4d2fcc8dfa0f05ebfe24c9864
SSDEEP

192:ywEA3ONU9nTNFW6ZhQ6vAVItG+k17dmaV30rAoGaHZoyodpMX66KALB6qdN:DaU7FW6ZhQ6vnsqYEe6VNKoTdN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 1264	2452	rundll32.exe	28
PID 2452 wrote to memory of 1264	2452	rundll32.exe	28
PID 2452 wrote to memory of 1264	2452	rundll32.exe	28
PID 2452 wrote to memory of 1264	2452	rundll32.exe	28
PID 2452 wrote to memory of 1264	2452	rundll32.exe	28
PID 2452 wrote to memory of 1264	2452	rundll32.exe	28
PID 2452 wrote to memory of 1264	2452	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23ffb792a8544b366bd69d9b3b23cce2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23ffb792a8544b366bd69d9b3b23cce2_JaffaCakes118.dll,#1
  2⤵
  PID:1264

memory/1264-0-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download