19c7a1c49f690c9127983f9a27841e949de89e3642f161b55fe5229317d2ce41

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 12:03

Target

2c45b229dcdf46a70e46eaa6f13a6951_JaffaCakes118.dll
Size

46KB
MD5

2c45b229dcdf46a70e46eaa6f13a6951
SHA1

aee24160d6e6a6d970cf6cf115d53da5f9a84133
SHA256

19c7a1c49f690c9127983f9a27841e949de89e3642f161b55fe5229317d2ce41
SHA512

38a0b5e4c5f2c51c0c1169eb311a173a8e7903b8c9d5cba5178ee58410a69f96aa855c63c9246e30bcb1aa3b271eb908b8e30feee8cf06fb524417a387216d15
SSDEEP

768:jeJqDgzze14JWwoyXwmtMyS7r1HkjjlgjF5H/TIt0jHgvuNqZs6USC:j38mGTgVyS7r1HkjJC/TIt0SuILjC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 1940	2348	rundll32.exe	30
PID 2348 wrote to memory of 1940	2348	rundll32.exe	30
PID 2348 wrote to memory of 1940	2348	rundll32.exe	30
PID 2348 wrote to memory of 1940	2348	rundll32.exe	30
PID 2348 wrote to memory of 1940	2348	rundll32.exe	30
PID 2348 wrote to memory of 1940	2348	rundll32.exe	30
PID 2348 wrote to memory of 1940	2348	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c45b229dcdf46a70e46eaa6f13a6951_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c45b229dcdf46a70e46eaa6f13a6951_JaffaCakes118.dll,#1
  2⤵
  PID:1940

memory/1940-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download