1752c964e4df122f027afa6a29e73707c8466f156613f2821512147d96fa31c8

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 03:17

Target

247213b8b666cd5f64ed027a4adfd146_JaffaCakes118.dll
Size

26KB
MD5

247213b8b666cd5f64ed027a4adfd146
SHA1

cf1f30e616718b4093622773e4922ca7a0a58a55
SHA256

1752c964e4df122f027afa6a29e73707c8466f156613f2821512147d96fa31c8
SHA512

51b0d4685808348b17d7e37e5db126c185f1d81acd5ead5d0e030628ad8a35dc86c6f6c5141a7c197d29ebd193d7e08c0e244c6539c067e3c1f8fa2381ac1b61
SSDEEP

384:J9AHxUSoqujGdKnGQm3K6x8+/8tqRfrCjMAhgxLCJYevcuPB1AWBatnSfQmu:wKSoquyd0GQz10TCjMA6RzUutnSf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2364	2264	rundll32.exe	28
PID 2264 wrote to memory of 2364	2264	rundll32.exe	28
PID 2264 wrote to memory of 2364	2264	rundll32.exe	28
PID 2264 wrote to memory of 2364	2264	rundll32.exe	28
PID 2264 wrote to memory of 2364	2264	rundll32.exe	28
PID 2264 wrote to memory of 2364	2264	rundll32.exe	28
PID 2264 wrote to memory of 2364	2264	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\247213b8b666cd5f64ed027a4adfd146_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\247213b8b666cd5f64ed027a4adfd146_JaffaCakes118.dll,#1
  2⤵
  PID:2364

memory/2364-0-0x0000000000130000-0x000000000013C000-memory.dmp

Filesize
48KB

Download