4f414d2ee468c5786ec7d84c2566abc54c01dbe076a8fd32ddd2e6fb93178ccb

Analysis

max time kernel
17s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 19:11

Target

294ff077ffaf4f90d76a6dbff46408f0_JaffaCakes118.dll
Size

32KB
MD5

294ff077ffaf4f90d76a6dbff46408f0
SHA1

e3a625c0fa99f5d13f1fe1120dd495e4d84474b5
SHA256

4f414d2ee468c5786ec7d84c2566abc54c01dbe076a8fd32ddd2e6fb93178ccb
SHA512

06a8bbed3663da4854583875284cf595914d37cdb3524f1f03a695baf16b638eb538aff76ee653156c02ab296adff61ded49d0f707aea78aeb6c53f02a0dcd5a
SSDEEP

384:2WbGo20m8V+RKM797uV0Q8Wmg4jW1HTICiY1Do+pY5z8MKyvzGZ4eF6YyclL6plC:xbcSiK3bb4jWRU+EvPeF6YyUecGm9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1052	1908	rundll32.exe	29
PID 1908 wrote to memory of 1052	1908	rundll32.exe	29
PID 1908 wrote to memory of 1052	1908	rundll32.exe	29
PID 1908 wrote to memory of 1052	1908	rundll32.exe	29
PID 1908 wrote to memory of 1052	1908	rundll32.exe	29
PID 1908 wrote to memory of 1052	1908	rundll32.exe	29
PID 1908 wrote to memory of 1052	1908	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\294ff077ffaf4f90d76a6dbff46408f0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\294ff077ffaf4f90d76a6dbff46408f0_JaffaCakes118.dll,#1
  2⤵
  PID:1052

memory/1052-1-0x0000000000140000-0x0000000000145000-memory.dmp

Filesize
20KB

Download
memory/1052-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download