244ed5ec238b329425bcf7a08bd3ea6bd8ef0f52990711fdf6da169afd3d773b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 14:47

Target

2cbee9c7b8d2684a5bac7811e3aac94e_JaffaCakes118.dll
Size

78KB
MD5

2cbee9c7b8d2684a5bac7811e3aac94e
SHA1

9255c2f6d20e5b56b74f40bd91cd0fcf77b1480c
SHA256

244ed5ec238b329425bcf7a08bd3ea6bd8ef0f52990711fdf6da169afd3d773b
SHA512

2aa3200454b58b32fe98bea4106bbed892a710b5c3b2335ebb8195d8e466cd1a1483646faf56bf25c99a7602d6e1e18bcd012d7543b0b70945d8e1cd9f9867ac
SSDEEP

1536:BMMObIsZaUQxJUHmoW7qhWnGMn3jO1cdooaAoodtmTFwuQi16mlD:iNERpxJUiWY40aBMtmZBt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2356	2120	rundll32.exe	30
PID 2120 wrote to memory of 2356	2120	rundll32.exe	30
PID 2120 wrote to memory of 2356	2120	rundll32.exe	30
PID 2120 wrote to memory of 2356	2120	rundll32.exe	30
PID 2120 wrote to memory of 2356	2120	rundll32.exe	30
PID 2120 wrote to memory of 2356	2120	rundll32.exe	30
PID 2120 wrote to memory of 2356	2120	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cbee9c7b8d2684a5bac7811e3aac94e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cbee9c7b8d2684a5bac7811e3aac94e_JaffaCakes118.dll,#1
  2⤵
  PID:2356

memory/2356-2-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/2356-1-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/2356-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download