c5a2452470888835c46d7fdebd4d40088ce03609dc789067d7aefe4e8e4abb76

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 00:47

Target

2e6c8abf001ce08c0d926df4549b5d44_JaffaCakes118.dll
Size

76KB
MD5

2e6c8abf001ce08c0d926df4549b5d44
SHA1

40835f42eeaba1f84c726f26eb549bd47c345ef4
SHA256

c5a2452470888835c46d7fdebd4d40088ce03609dc789067d7aefe4e8e4abb76
SHA512

38ab31d3104742c3de2267a88845db382fecd645a50084f2600d1ef1352c7d9d5f0f2ba415d95d72e605677278e9c17d4cb0dbd3339dffc95b610b27b1cf6f0e
SSDEEP

1536:JhEkiyBylmR4M1/V9JIKKZhFlZkuO3NmmKUBJGbvlCPf/:PExlG4ynCKWhFtO3NmmfBKv+3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 1884	2144	rundll32.exe	28
PID 2144 wrote to memory of 1884	2144	rundll32.exe	28
PID 2144 wrote to memory of 1884	2144	rundll32.exe	28
PID 2144 wrote to memory of 1884	2144	rundll32.exe	28
PID 2144 wrote to memory of 1884	2144	rundll32.exe	28
PID 2144 wrote to memory of 1884	2144	rundll32.exe	28
PID 2144 wrote to memory of 1884	2144	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e6c8abf001ce08c0d926df4549b5d44_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e6c8abf001ce08c0d926df4549b5d44_JaffaCakes118.dll,#1
  2⤵
  PID:1884

memory/1884-1-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/1884-0-0x0000000010012000-0x0000000010021000-memory.dmp

Filesize
60KB

Download