31ca2ebe397f2f75b4a8a512c470714a3385faacc34d6b5017fc66c74e9939ee

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 07:43

Target

2527427facf3d88897a5a22e5e7ef25f_JaffaCakes118.dll
Size

236KB
MD5

2527427facf3d88897a5a22e5e7ef25f
SHA1

94b637379d25fbdd96b7f399080d94a1bb211c26
SHA256

31ca2ebe397f2f75b4a8a512c470714a3385faacc34d6b5017fc66c74e9939ee
SHA512

0ca5de41faed2ff3785d2abb05c5972ed881696df1317a2eb0b3b408bf5ae0e36ee51eb79567315441ff6d535899a3234c6ee5498cc9629749fef1de6a74f282
SSDEEP

3072:QbqyspRbT9XcmglwwpmZ26v0uq4teaSRLn7bqb2WjIyrnC4+PT8h/0GUqDfuoM5Q:VyKT9XElwwc26v0ufAx7GF8e/0iDWop1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2940	2896	rundll32.exe	29
PID 2896 wrote to memory of 2940	2896	rundll32.exe	29
PID 2896 wrote to memory of 2940	2896	rundll32.exe	29
PID 2896 wrote to memory of 2940	2896	rundll32.exe	29
PID 2896 wrote to memory of 2940	2896	rundll32.exe	29
PID 2896 wrote to memory of 2940	2896	rundll32.exe	29
PID 2896 wrote to memory of 2940	2896	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2527427facf3d88897a5a22e5e7ef25f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2527427facf3d88897a5a22e5e7ef25f_JaffaCakes118.dll,#1
  2⤵
  PID:2940

memory/2940-2-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/2940-1-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/2940-0-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download