31997c2b27431e754a8953bca2545f15ebe9a90b319272f5b25afa9df99ababd

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 02:51

Target

246129e837965a6b8f3dd843983f3a45_JaffaCakes118.dll
Size

126KB
MD5

246129e837965a6b8f3dd843983f3a45
SHA1

97cef854d83514bfb2450bc3f352f5d410792dcf
SHA256

31997c2b27431e754a8953bca2545f15ebe9a90b319272f5b25afa9df99ababd
SHA512

e49f5024a3cedb1367c81b2b16abdc54fec2e2adeaaab5c195f438959b980960b64e746e7a305be2718c669db8026775db1b564eb751dde754252b041f852538
SSDEEP

3072:oLWxkx+M+g6ZK4BjG8cBxR/Rk0sK2qLkNvHa7q:27x+u6ZX1Cq0slqANvHYq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2932	2420	rundll32.exe	28
PID 2420 wrote to memory of 2932	2420	rundll32.exe	28
PID 2420 wrote to memory of 2932	2420	rundll32.exe	28
PID 2420 wrote to memory of 2932	2420	rundll32.exe	28
PID 2420 wrote to memory of 2932	2420	rundll32.exe	28
PID 2420 wrote to memory of 2932	2420	rundll32.exe	28
PID 2420 wrote to memory of 2932	2420	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\246129e837965a6b8f3dd843983f3a45_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\246129e837965a6b8f3dd843983f3a45_JaffaCakes118.dll,#1
  2⤵
  PID:2932

memory/2932-0-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/2932-1-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download