7db2b4a1b2847cb8af7be87897e9f5fa71e75e151b9860b74b3b473386b5cef3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 23:49

Target

2e44701a14986e0d82431926680d721d_JaffaCakes118.dll
Size

77KB
MD5

2e44701a14986e0d82431926680d721d
SHA1

025b225b6f39d1791895108ea19632b7362ce8ca
SHA256

7db2b4a1b2847cb8af7be87897e9f5fa71e75e151b9860b74b3b473386b5cef3
SHA512

12cb116287895f6ef92cbf7c6c92031b7dd79b1201f2dcd78d47a320470c39faec28129ec482a0402f1994f84fcfe8f196d22f0f341f1a2ccbab98b43d615fb6
SSDEEP

1536:/9mNIOy5o7v+8JEkAixo2CaJCvFuZ4YOqSlE3ZbHYjkxbFKIn8gp2:Wy5oD+L7faJCvFfUYOTHtFKI8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 764	2632	rundll32.exe	31
PID 2632 wrote to memory of 764	2632	rundll32.exe	31
PID 2632 wrote to memory of 764	2632	rundll32.exe	31
PID 2632 wrote to memory of 764	2632	rundll32.exe	31
PID 2632 wrote to memory of 764	2632	rundll32.exe	31
PID 2632 wrote to memory of 764	2632	rundll32.exe	31
PID 2632 wrote to memory of 764	2632	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e44701a14986e0d82431926680d721d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e44701a14986e0d82431926680d721d_JaffaCakes118.dll,#1
  2⤵
  PID:764

memory/764-0-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download