1af06934c6a0af0744fa4ac5c68cd17c4b084f72b647be0fd0ea3925650b8be0

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 07:21

Target

2b72d06ae6192729439785bb4bd96da7_JaffaCakes118.dll
Size

564KB
MD5

2b72d06ae6192729439785bb4bd96da7
SHA1

6a7be2f2ab1e0233834f19f4d7e624905bafc5e5
SHA256

1af06934c6a0af0744fa4ac5c68cd17c4b084f72b647be0fd0ea3925650b8be0
SHA512

a70b0c05f677926202a94f2c771375d9390a97a9bdc09161090f20da47dadc88a7279ce98da33008d5746a2e77285870667ca80de7a2f20f72efda0729d67b65
SSDEEP

12288:V5G56dH2uDnkHE/aZS14/RSiRSuf7x/1d8r4so:+6h2GEESUFufV/fe

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2292	2460	rundll32.exe	30
PID 2460 wrote to memory of 2292	2460	rundll32.exe	30
PID 2460 wrote to memory of 2292	2460	rundll32.exe	30
PID 2460 wrote to memory of 2292	2460	rundll32.exe	30
PID 2460 wrote to memory of 2292	2460	rundll32.exe	30
PID 2460 wrote to memory of 2292	2460	rundll32.exe	30
PID 2460 wrote to memory of 2292	2460	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b72d06ae6192729439785bb4bd96da7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b72d06ae6192729439785bb4bd96da7_JaffaCakes118.dll,#1
  2⤵
  PID:2292

memory/2292-0-0x0000000000630000-0x00000000006B2000-memory.dmp

Filesize
520KB

Download