ab5fc0b13dcfdf21ff4cb458ddf18af030d56c3cc0fe7db4b17f6a3779374953

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 09:22

Target

2bcdac81ecff0ca2382d5d6bf3faae86_JaffaCakes118.dll
Size

76KB
MD5

2bcdac81ecff0ca2382d5d6bf3faae86
SHA1

f2906d423acbe09603a41e793b18be3a828665e1
SHA256

ab5fc0b13dcfdf21ff4cb458ddf18af030d56c3cc0fe7db4b17f6a3779374953
SHA512

06853ed71d7d8de247ecd55cb7b08a88b61bb1a152855084738ae41fd954c8619c03a0d0acc19271cdd587f92b89d43b25a490713dfd7535984908bb0ce45fdc
SSDEEP

1536:dyzJaj6oGDuhmPLTBeKJk9bS0SGbcK9RsMDt11x:dyzJajeDIELNet92nSzDt1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2168	2172	rundll32.exe	30
PID 2172 wrote to memory of 2168	2172	rundll32.exe	30
PID 2172 wrote to memory of 2168	2172	rundll32.exe	30
PID 2172 wrote to memory of 2168	2172	rundll32.exe	30
PID 2172 wrote to memory of 2168	2172	rundll32.exe	30
PID 2172 wrote to memory of 2168	2172	rundll32.exe	30
PID 2172 wrote to memory of 2168	2172	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bcdac81ecff0ca2382d5d6bf3faae86_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bcdac81ecff0ca2382d5d6bf3faae86_JaffaCakes118.dll,#1
  2⤵
  PID:2168

memory/2168-0-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download