92469e193326d8b926b7aa0821b5f55a127386c1f1dcfd42a8f53a213f539f5c

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 01:53

Target

2e9844a3c350949d0b40b81e12f8a347_JaffaCakes118.dll
Size

65KB
MD5

2e9844a3c350949d0b40b81e12f8a347
SHA1

12a27db6f2b59263934f16f0d6b4742d56aa5284
SHA256

92469e193326d8b926b7aa0821b5f55a127386c1f1dcfd42a8f53a213f539f5c
SHA512

aac22f236ec5305cacabc6cc497ab8a5f5d5801b17b16bf3391b9fdedb8f3b7295d5fd16df976e1a47e049d7367dec17773afbab7ab6d939eed4e8030e0aaa0b
SSDEEP

1536:Bm1NGJVGoOg3aPEpOOpRYVRYXRQuYcNeA0:kX0V7Og3aPDgSjYBQuYco

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 772	1580	rundll32.exe	30
PID 1580 wrote to memory of 772	1580	rundll32.exe	30
PID 1580 wrote to memory of 772	1580	rundll32.exe	30
PID 1580 wrote to memory of 772	1580	rundll32.exe	30
PID 1580 wrote to memory of 772	1580	rundll32.exe	30
PID 1580 wrote to memory of 772	1580	rundll32.exe	30
PID 1580 wrote to memory of 772	1580	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e9844a3c350949d0b40b81e12f8a347_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e9844a3c350949d0b40b81e12f8a347_JaffaCakes118.dll,#1
  2⤵
  PID:772

memory/772-2-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/772-1-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/772-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download