354b7ed28e969b5cb1492a033a887f9f1bf7c6795bc4ca38c65599b5ff09a7af

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 19:38

Target

2603aed995f3bc6c719298276bb6d5fd_JaffaCakes118.dll
Size

218KB
MD5

2603aed995f3bc6c719298276bb6d5fd
SHA1

0e651786e817f06a0aab16ab2b73afd5fc80ff74
SHA256

354b7ed28e969b5cb1492a033a887f9f1bf7c6795bc4ca38c65599b5ff09a7af
SHA512

faa672c13c886ddadc9ddb6e0194917f7acf2426f583d64e3105d3936bf726f506d231bc0ee170899a914500483617dbc037b16dac9f8466a6042388a13d9c3c
SSDEEP

3072:lyvO7ifygWXk+QZEWPrnic2aZIBfiVBBhV+bGn7usUpYCF+MJACEiXMmT5VaauSD:lICH0JZEO7ic8f0YG7u3pnFXEi/wal

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2256	2320	rundll32.exe	28
PID 2320 wrote to memory of 2256	2320	rundll32.exe	28
PID 2320 wrote to memory of 2256	2320	rundll32.exe	28
PID 2320 wrote to memory of 2256	2320	rundll32.exe	28
PID 2320 wrote to memory of 2256	2320	rundll32.exe	28
PID 2320 wrote to memory of 2256	2320	rundll32.exe	28
PID 2320 wrote to memory of 2256	2320	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2603aed995f3bc6c719298276bb6d5fd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2603aed995f3bc6c719298276bb6d5fd_JaffaCakes118.dll,#1
  2⤵
  PID:2256

memory/2256-1-0x0000000010000000-0x000000001005F000-memory.dmp

Filesize
380KB

Download
memory/2256-0-0x0000000000240000-0x0000000000257000-memory.dmp

Filesize
92KB

Download