c533a27e28d59b6281dc88a7fb89971a582db5f5d165180de7106f86df0d96c6

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 17:37

Target

29067077db15b0c4cbdf4467d181454e_JaffaCakes118.dll
Size

36KB
MD5

29067077db15b0c4cbdf4467d181454e
SHA1

77d1b130858fdc9c9ad9f31dfd700e4b315ab063
SHA256

c533a27e28d59b6281dc88a7fb89971a582db5f5d165180de7106f86df0d96c6
SHA512

0b90bd43859ca6b83c31ff62beab727f4f979081740887902308abe46bcec00d0d5181f400c6344e389f9ded1fc117d8b68904b91ec43014ac730a721572e203
SSDEEP

384:Tk0ZGo6MHVNKvP2sweOiBT2b+/9dpNrVoSK6MxhSNHVsKGIDQyTEdFKWjudB7:Tk0Go91NQNsxMdBWk1JrVjN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2148	2476	rundll32.exe	29
PID 2476 wrote to memory of 2148	2476	rundll32.exe	29
PID 2476 wrote to memory of 2148	2476	rundll32.exe	29
PID 2476 wrote to memory of 2148	2476	rundll32.exe	29
PID 2476 wrote to memory of 2148	2476	rundll32.exe	29
PID 2476 wrote to memory of 2148	2476	rundll32.exe	29
PID 2476 wrote to memory of 2148	2476	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29067077db15b0c4cbdf4467d181454e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\29067077db15b0c4cbdf4467d181454e_JaffaCakes118.dll,#1
  2⤵
  PID:2148

memory/2148-1-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/2148-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download