07574e72606a502c1dbd1e520bccc94d45d6f09962902127e17de77b4e293e3c

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 05:53

Target

24d9b7f06677296a3bb56f7b8d86b892_JaffaCakes118.dll
Size

238KB
MD5

24d9b7f06677296a3bb56f7b8d86b892
SHA1

a123a258441d1a288ad5b15aec92c3e9c9806d48
SHA256

07574e72606a502c1dbd1e520bccc94d45d6f09962902127e17de77b4e293e3c
SHA512

9dc96bde238ab9dce666843fcf88f28fc8a646069743a42712bd00abaa08549d2e14ee60f6918da5c2a85a78f455d6aa32fe2bf936b4a5510c83248e70208e73
SSDEEP

6144:2wc6zBSiK1/bx0MmTgxEolCj2uEpAe8bu7je:25LHrmTSbQQpA9bu7S

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2100	2056	rundll32.exe	28
PID 2056 wrote to memory of 2100	2056	rundll32.exe	28
PID 2056 wrote to memory of 2100	2056	rundll32.exe	28
PID 2056 wrote to memory of 2100	2056	rundll32.exe	28
PID 2056 wrote to memory of 2100	2056	rundll32.exe	28
PID 2056 wrote to memory of 2100	2056	rundll32.exe	28
PID 2056 wrote to memory of 2100	2056	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24d9b7f06677296a3bb56f7b8d86b892_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24d9b7f06677296a3bb56f7b8d86b892_JaffaCakes118.dll,#1
  2⤵
  PID:2100

memory/2100-1-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/2100-2-0x00000000001A0000-0x00000000001DA000-memory.dmp

Filesize
232KB

Download
memory/2100-0-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download