9775baccfa4ebd99dc2681e77438bfd9eb1542b65b741603ff84da4af54eae7b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 08:56

Target

27f94077de7b68f59d994d353fc4b1fd_JaffaCakes118.dll
Size

247KB
MD5

27f94077de7b68f59d994d353fc4b1fd
SHA1

dadb9fd1cf123388c94cf4636d6ed5e756a7e348
SHA256

9775baccfa4ebd99dc2681e77438bfd9eb1542b65b741603ff84da4af54eae7b
SHA512

dc4028461195731bc6afc60c15a8ae54683ed7d0f1c60734f3a888e369117fbb24a21674ecef226252dc14de14065eb192a6534b41a2093fd79372df423753e5
SSDEEP

6144:BkNG+NdkuFGXBYV3APFkvCN6J+zUwvWgxUH:BkDNd3GXBi3UFkvfJ+4+TE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2260	2240	rundll32.exe	28
PID 2240 wrote to memory of 2260	2240	rundll32.exe	28
PID 2240 wrote to memory of 2260	2240	rundll32.exe	28
PID 2240 wrote to memory of 2260	2240	rundll32.exe	28
PID 2240 wrote to memory of 2260	2240	rundll32.exe	28
PID 2240 wrote to memory of 2260	2240	rundll32.exe	28
PID 2240 wrote to memory of 2260	2240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27f94077de7b68f59d994d353fc4b1fd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27f94077de7b68f59d994d353fc4b1fd_JaffaCakes118.dll,#1
  2⤵
  PID:2260

memory/2260-1-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/2260-0-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/2260-2-0x0000000000240000-0x000000000027C000-memory.dmp

Filesize
240KB

Download