e34bc442d9abdda7ec3e5b6e172a050f8beeddf8b097a4b6f40e914286563733

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 15:12

Target

289d4cd3b760ada40c313148c2f4c7e4_JaffaCakes118.dll
Size

39KB
MD5

289d4cd3b760ada40c313148c2f4c7e4
SHA1

d112719c8ef1003a37db5c2cee69694eb848f7bb
SHA256

e34bc442d9abdda7ec3e5b6e172a050f8beeddf8b097a4b6f40e914286563733
SHA512

5a53f841aff1ea1221db6b6867d3c9d53116f59313e7b7a89aaea8aa7ab83c3cdc99dce2659ae3884e4992d128feea42b725cde851ce1175be14a999561a43f1
SSDEEP

768:TJRjcTrlNoobbTBsXLJjSBmKInOEBE2+xedSu5Tuh1nKcAW4Po9Sy:NR8lNoobblsXLJjiretyvI8u5TuhhIWH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 600 wrote to memory of 1048	600	rundll32.exe	30
PID 600 wrote to memory of 1048	600	rundll32.exe	30
PID 600 wrote to memory of 1048	600	rundll32.exe	30
PID 600 wrote to memory of 1048	600	rundll32.exe	30
PID 600 wrote to memory of 1048	600	rundll32.exe	30
PID 600 wrote to memory of 1048	600	rundll32.exe	30
PID 600 wrote to memory of 1048	600	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\289d4cd3b760ada40c313148c2f4c7e4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\289d4cd3b760ada40c313148c2f4c7e4_JaffaCakes118.dll,#1
  2⤵
  PID:1048

memory/1048-0-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download