09a66dbaaa88212589a9b51f0595c82f835b8c76fdfc1729ec25bc8eb3c6caf7

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 17:02

Target

259b0b06ffff1e707b00e86d516b3112_JaffaCakes118.dll
Size

14KB
MD5

259b0b06ffff1e707b00e86d516b3112
SHA1

b74672e06e9234e8831b69c135ec1b6f2a0265e5
SHA256

09a66dbaaa88212589a9b51f0595c82f835b8c76fdfc1729ec25bc8eb3c6caf7
SHA512

eb2a2529fa1f5a1f450cd147b9cb5e83d4a0eb7a19e087c1d7546337f53a25481dbe1f63841f5f164018a432e581bd67a54675fbdf79fffb5a867f7330e1c709
SSDEEP

384:45FetYTw8GBvmFpnKcJyyERPI7pVsS+ax:4H4yGBmpKA5ER6vVP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2892	2740	rundll32.exe	28
PID 2740 wrote to memory of 2892	2740	rundll32.exe	28
PID 2740 wrote to memory of 2892	2740	rundll32.exe	28
PID 2740 wrote to memory of 2892	2740	rundll32.exe	28
PID 2740 wrote to memory of 2892	2740	rundll32.exe	28
PID 2740 wrote to memory of 2892	2740	rundll32.exe	28
PID 2740 wrote to memory of 2892	2740	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\259b0b06ffff1e707b00e86d516b3112_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\259b0b06ffff1e707b00e86d516b3112_JaffaCakes118.dll,#1
  2⤵
  PID:2892

memory/2892-0-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download