ed92f50e63da06ba1cb705afd1117f6c25bccadbfdc203ecf733e3f33cb52d68

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 11:43

Target

2c35b1c1fe5de16ca56aa1895b9f9cb0_JaffaCakes118.dll
Size

102KB
MD5

2c35b1c1fe5de16ca56aa1895b9f9cb0
SHA1

ea1f5136b900c6f73eb1a7f5f0ff9af549f84aec
SHA256

ed92f50e63da06ba1cb705afd1117f6c25bccadbfdc203ecf733e3f33cb52d68
SHA512

a73b55aecdc3374c6240b20b0669e7d883e4bbfaafbd2de624ecb47aafdf033fc04f5f4b03c00cca4c5e8ef3b17812bdcb22f20fd9cc48f0dfae5b7a1651766b
SSDEEP

3072:7RCVcAHzYRjDfgVYIzfoHOJFykZdHUSVVaRKeR8W:7syzR/8eOekbHPURQW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 1944	2388	rundll32.exe	30
PID 2388 wrote to memory of 1944	2388	rundll32.exe	30
PID 2388 wrote to memory of 1944	2388	rundll32.exe	30
PID 2388 wrote to memory of 1944	2388	rundll32.exe	30
PID 2388 wrote to memory of 1944	2388	rundll32.exe	30
PID 2388 wrote to memory of 1944	2388	rundll32.exe	30
PID 2388 wrote to memory of 1944	2388	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c35b1c1fe5de16ca56aa1895b9f9cb0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c35b1c1fe5de16ca56aa1895b9f9cb0_JaffaCakes118.dll,#1
  2⤵
  PID:1944

memory/1944-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download