cbb9ea61f110247cd581ec6f6065f8d78f847e50025bb518e0278fe2f105879d

Analysis

max time kernel
13s
max time network
21s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 00:36

Target

2e652c0fdefc281ce8bcbabc4e9b6525_JaffaCakes118.dll
Size

119KB
MD5

2e652c0fdefc281ce8bcbabc4e9b6525
SHA1

2e79889a2ee264452731abb21241334636b76dc5
SHA256

cbb9ea61f110247cd581ec6f6065f8d78f847e50025bb518e0278fe2f105879d
SHA512

c8e66c89e88b6423dffa25019359d2000bc43280074b3d8a7283efd81c0a7c9efb01f35851cfe4762c7a4a99b33b8e1f2b1f88eec34aa748c73c2fed22bfb2e7
SSDEEP

1536:CBhiQQDpxRSVW430wRu5OPmVd1GSSfe4KaXe9eGC4shg8mAvWBfvNAhIM/Bhp:6O93Svu5OPOdbSfJEwmAvWZvNBM/Bhp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2076	2840	rundll32.exe	29
PID 2840 wrote to memory of 2076	2840	rundll32.exe	29
PID 2840 wrote to memory of 2076	2840	rundll32.exe	29
PID 2840 wrote to memory of 2076	2840	rundll32.exe	29
PID 2840 wrote to memory of 2076	2840	rundll32.exe	29
PID 2840 wrote to memory of 2076	2840	rundll32.exe	29
PID 2840 wrote to memory of 2076	2840	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e652c0fdefc281ce8bcbabc4e9b6525_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e652c0fdefc281ce8bcbabc4e9b6525_JaffaCakes118.dll,#1
  2⤵
  PID:2076

memory/2076-1-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download
memory/2076-0-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download