6063f4012d41644a1428c56062c120889135e2e684b38882c1a38581eae1b526

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 23:05

Target

2e27c6e1190ae479462d4a4628803713_JaffaCakes118.dll
Size

543KB
MD5

2e27c6e1190ae479462d4a4628803713
SHA1

ea7cfd7b94561fe7529fe4b6bef21d732f7e4416
SHA256

6063f4012d41644a1428c56062c120889135e2e684b38882c1a38581eae1b526
SHA512

f21e50bed282ea17526f6cb41878b14c35ed55e9e33185bafd5b9282b161af944dbe545476dccd5e3381dfd1886845fa9180d7df8f4a186741baf01efc5004a3
SSDEEP

6144:cWOEXJzZo4zXlW+5IME+bCI+Qj4NabFuxzMBU9mlUHErn9JvzuPOi2cTBjsU8lU:kezFXlW+zX4NOum2HEbzvKPOi2cT6Uy

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 3068	2280	rundll32.exe	30
PID 2280 wrote to memory of 3068	2280	rundll32.exe	30
PID 2280 wrote to memory of 3068	2280	rundll32.exe	30
PID 2280 wrote to memory of 3068	2280	rundll32.exe	30
PID 2280 wrote to memory of 3068	2280	rundll32.exe	30
PID 2280 wrote to memory of 3068	2280	rundll32.exe	30
PID 2280 wrote to memory of 3068	2280	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e27c6e1190ae479462d4a4628803713_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e27c6e1190ae479462d4a4628803713_JaffaCakes118.dll,#1
  2⤵
  PID:3068

memory/3068-0-0x0000000000730000-0x00000000007C1000-memory.dmp

Filesize
580KB

Download