f36c9f14bf7fc044b3d21c2bffbfc506aeb8df7a004e5d1bd9c59fc6c648e8b1

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 05:17

Target

2b1bbc5fdfb4ae9f2b821e34f2b03e93_JaffaCakes118.dll
Size

116KB
MD5

2b1bbc5fdfb4ae9f2b821e34f2b03e93
SHA1

8ff39447b642c6fa682a82325f7b9452f8824328
SHA256

f36c9f14bf7fc044b3d21c2bffbfc506aeb8df7a004e5d1bd9c59fc6c648e8b1
SHA512

929bf3d560a29a01a2c56a5763ea73da85ef5cb6370edbf33c33814e64153b73f4a8ee46b970dc62c738f5c61772b1bbdf15912fcf7ad2677f8f029d2b603f5a
SSDEEP

3072:HT6aRIrPcMa66yOZIyGXyR6iuZt1vAGUS9HrW:HTVILdaMV6RHCfvoSJrW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2740	2816	rundll32.exe	30
PID 2816 wrote to memory of 2740	2816	rundll32.exe	30
PID 2816 wrote to memory of 2740	2816	rundll32.exe	30
PID 2816 wrote to memory of 2740	2816	rundll32.exe	30
PID 2816 wrote to memory of 2740	2816	rundll32.exe	30
PID 2816 wrote to memory of 2740	2816	rundll32.exe	30
PID 2816 wrote to memory of 2740	2816	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b1bbc5fdfb4ae9f2b821e34f2b03e93_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b1bbc5fdfb4ae9f2b821e34f2b03e93_JaffaCakes118.dll,#1
  2⤵
  PID:2740

memory/2740-2-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2740-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2740-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download