e96b106232d8ce05b3fe00c1a5b353935ccdbfacb365e6c899dd95137554279e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 00:22

Target

23fed378e2979e4d83d9d4c8504ea692_JaffaCakes118.dll
Size

78KB
MD5

23fed378e2979e4d83d9d4c8504ea692
SHA1

fbe74696f971f26acd90b59d4b24bac0a5443ca3
SHA256

e96b106232d8ce05b3fe00c1a5b353935ccdbfacb365e6c899dd95137554279e
SHA512

e112fd007dd9ba084c39193d9ec32cff20e03c25aa55c4be70bfff7548b673b9b8ef31caeeb0c548acdd6d6026fdf482dee3d7c4a19a34c2baf8d8b20b7e67b0
SSDEEP

1536:0Dpp+eG2YywRBJu80dAA3u0SOVbERd1oGrCJzvr1JJ6/My4vnPGW:WpZG2YyJdAA3u04Rd1xWJLrXJNh/b

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2060	2056	rundll32.exe	28
PID 2056 wrote to memory of 2060	2056	rundll32.exe	28
PID 2056 wrote to memory of 2060	2056	rundll32.exe	28
PID 2056 wrote to memory of 2060	2056	rundll32.exe	28
PID 2056 wrote to memory of 2060	2056	rundll32.exe	28
PID 2056 wrote to memory of 2060	2056	rundll32.exe	28
PID 2056 wrote to memory of 2060	2056	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23fed378e2979e4d83d9d4c8504ea692_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23fed378e2979e4d83d9d4c8504ea692_JaffaCakes118.dll,#1
  2⤵
  PID:2060

memory/2060-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download