83c71dc1e7fcaced11a96d7867e7cf123067b3f1d1419d05062da0b94ce26737

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 00:10

Target

26c144664a5720fc9b10834f92893f56_JaffaCakes118.dll
Size

232KB
MD5

26c144664a5720fc9b10834f92893f56
SHA1

3dfb997f81cbca705a7699635a519955f0c5584d
SHA256

83c71dc1e7fcaced11a96d7867e7cf123067b3f1d1419d05062da0b94ce26737
SHA512

3c0e8117c39a5d0b8723915700617cd90408269c8d9976b37c9ddc6e8d2a7ae42f138798669400b22843b17138bcca5650c7311a5651f04b6fe38709b9fb2f8e
SSDEEP

6144:7nrLAX3ot4ectdRHycTFp+UsjkrW3hq/UXa6UYjCgplaEDF:nLO3ot4e2PHXrsIrAo/UjUfMl7DF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1676	2360	rundll32.exe	28
PID 2360 wrote to memory of 1676	2360	rundll32.exe	28
PID 2360 wrote to memory of 1676	2360	rundll32.exe	28
PID 2360 wrote to memory of 1676	2360	rundll32.exe	28
PID 2360 wrote to memory of 1676	2360	rundll32.exe	28
PID 2360 wrote to memory of 1676	2360	rundll32.exe	28
PID 2360 wrote to memory of 1676	2360	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26c144664a5720fc9b10834f92893f56_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\26c144664a5720fc9b10834f92893f56_JaffaCakes118.dll,#1
  2⤵
  PID:1676

memory/1676-0-0x0000000010000000-0x00000000100A8000-memory.dmp

Filesize
672KB

Download
memory/1676-1-0x0000000010000000-0x00000000100A8000-memory.dmp

Filesize
672KB

Download