64c84a9e3dd8d463c43313adf09d7ff7addb037cb6adb507077d5a7039d7fd26

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 04:39

Target

24a758a704d3d946a96435b151df1952_JaffaCakes118.dll
Size

107KB
MD5

24a758a704d3d946a96435b151df1952
SHA1

a6814d2b4773ee6f4f84dd2c4b86ae0566964eda
SHA256

64c84a9e3dd8d463c43313adf09d7ff7addb037cb6adb507077d5a7039d7fd26
SHA512

bf5b35de8862d103b71820bcea1781ee4af3818c48f39479caf99bfadf678e43b2464ac80c34b13890f20801f1156c76016005a8b3e9e9052ecbce42c891c977
SSDEEP

3072:rQQ2IUtMlwBUOknmseqwH06YJtcrpLEslhO92:rQQUtMlMUvmswwOos5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2228	2864	rundll32.exe	28
PID 2864 wrote to memory of 2228	2864	rundll32.exe	28
PID 2864 wrote to memory of 2228	2864	rundll32.exe	28
PID 2864 wrote to memory of 2228	2864	rundll32.exe	28
PID 2864 wrote to memory of 2228	2864	rundll32.exe	28
PID 2864 wrote to memory of 2228	2864	rundll32.exe	28
PID 2864 wrote to memory of 2228	2864	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24a758a704d3d946a96435b151df1952_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24a758a704d3d946a96435b151df1952_JaffaCakes118.dll,#1
  2⤵
  PID:2228

memory/2228-0-0x0000000000180000-0x00000000001A4000-memory.dmp

Filesize
144KB

Download