0c3286dd0255807018d71019c1de7f031af669117e705848c6be0d244d11a850

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 09:23

Target

2bce3283e8e0b7d52870e71000c74f2f_JaffaCakes118.dll
Size

24KB
MD5

2bce3283e8e0b7d52870e71000c74f2f
SHA1

9b11f4424a34057a28dd762959cf8ff0464ac56a
SHA256

0c3286dd0255807018d71019c1de7f031af669117e705848c6be0d244d11a850
SHA512

5f8e30443be7fefc5783d7c1fe25fee15647a7c7d7702bd270eed8a0943a681b2af3195671b06c4de2bf23c29cf092ad3fada4b387f16d12e0b111e1bb7355d8
SSDEEP

384:zboPlStmkYHLt5AOrfnknlB4F9J2UHXWAab0V0PkNe+IeYzvdojbqNb/2ch:zsPlStOLLLnknlQZLnNepdvdou

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2116	2272	rundll32.exe	31
PID 2272 wrote to memory of 2116	2272	rundll32.exe	31
PID 2272 wrote to memory of 2116	2272	rundll32.exe	31
PID 2272 wrote to memory of 2116	2272	rundll32.exe	31
PID 2272 wrote to memory of 2116	2272	rundll32.exe	31
PID 2272 wrote to memory of 2116	2272	rundll32.exe	31
PID 2272 wrote to memory of 2116	2272	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bce3283e8e0b7d52870e71000c74f2f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bce3283e8e0b7d52870e71000c74f2f_JaffaCakes118.dll,#1
  2⤵
  PID:2116

memory/2116-3-0x00000000001F0000-0x00000000001FD000-memory.dmp

Filesize
52KB

Download
memory/2116-2-0x00000000001E0000-0x00000000001ED000-memory.dmp

Filesize
52KB

Download
memory/2116-1-0x00000000001E0000-0x00000000001ED000-memory.dmp

Filesize
52KB

Download
memory/2116-0-0x00000000001E0000-0x00000000001ED000-memory.dmp

Filesize
52KB

Download
memory/2116-4-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download