faeeaead7a08444c696c21825c1a93042f2cd7b8e83125198a85ca22183d0e02

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 02:41

Target

2ab3dfc59fe7e8cc382a12499dc48d98_JaffaCakes118.dll
Size

62KB
MD5

2ab3dfc59fe7e8cc382a12499dc48d98
SHA1

a167628ae8b5c20abc67e9fe1620e46926ce4130
SHA256

faeeaead7a08444c696c21825c1a93042f2cd7b8e83125198a85ca22183d0e02
SHA512

9948e5f9d8cb1e71243102334468f3a567537722c7bd10dc694a1cf8e487bc0dbed8409a29c1d2d9609a47e3be6af89c8dc6f9e2592d7e1b35e7ead05fa5c3cb
SSDEEP

1536:90gYxJs6md2GQQ/XufcLDHlgQIcaX2nJ4ifWT5J40C65r:rYAvdJvXuZQIchWl9

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3060	rundll32.exe
3060	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 3060	1992	rundll32.exe	28
PID 1992 wrote to memory of 3060	1992	rundll32.exe	28
PID 1992 wrote to memory of 3060	1992	rundll32.exe	28
PID 1992 wrote to memory of 3060	1992	rundll32.exe	28
PID 1992 wrote to memory of 3060	1992	rundll32.exe	28
PID 1992 wrote to memory of 3060	1992	rundll32.exe	28
PID 1992 wrote to memory of 3060	1992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ab3dfc59fe7e8cc382a12499dc48d98_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ab3dfc59fe7e8cc382a12499dc48d98_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3060

memory/3060-3-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/3060-2-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/3060-1-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/3060-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download