fbe78508580ffd39d72e143f0636abf8a2c0de9b3844abe60741a4a59bcb5631

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 01:30

Target

2e8981159c94812fcccfe2df4efafb89_JaffaCakes118.dll
Size

97KB
MD5

2e8981159c94812fcccfe2df4efafb89
SHA1

f898e80f4fd3b6401890ca8e99bbafc4211a528d
SHA256

fbe78508580ffd39d72e143f0636abf8a2c0de9b3844abe60741a4a59bcb5631
SHA512

122d53da0c9c6bf1c47a5b4f7113a0d6dbb11fb07eb86aaf922bcbdb7efc4795685dd0152d4ac78bb279bc9a835503f936b43b5c6fe0311e9471ab0553a7b4f6
SSDEEP

3072:fH6ZDsfewb6Mv3j5u+La3Wt9agpohw9VkHja++O:fKzAb5u+LaSpR0Hb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 3004	2964	rundll32.exe	30
PID 2964 wrote to memory of 3004	2964	rundll32.exe	30
PID 2964 wrote to memory of 3004	2964	rundll32.exe	30
PID 2964 wrote to memory of 3004	2964	rundll32.exe	30
PID 2964 wrote to memory of 3004	2964	rundll32.exe	30
PID 2964 wrote to memory of 3004	2964	rundll32.exe	30
PID 2964 wrote to memory of 3004	2964	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e8981159c94812fcccfe2df4efafb89_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e8981159c94812fcccfe2df4efafb89_JaffaCakes118.dll,#1
  2⤵
  PID:3004

memory/3004-1-0x0000000010033000-0x0000000010034000-memory.dmp

Filesize
4KB

Download
memory/3004-0-0x0000000000200000-0x0000000000217000-memory.dmp

Filesize
92KB

Download
memory/3004-2-0x0000000000200000-0x0000000000202000-memory.dmp

Filesize
8KB

Download