c2cc0de2c8529046dc58bd586e5675fa562d098956b2d0369695febd795690fb

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 02:27

Target

2eae3e847e7def896c3005e9dae7731e_JaffaCakes118.dll
Size

14KB
MD5

2eae3e847e7def896c3005e9dae7731e
SHA1

18511d5bf3d1a4ada82c1f4defadfe0573f29df9
SHA256

c2cc0de2c8529046dc58bd586e5675fa562d098956b2d0369695febd795690fb
SHA512

06d04ed2a5c18ae577961f1aec94cd2018cb6663fd6adbff2ac2336e7453473325ff4b96a4ec762c563a608a5c33e7c052a18936c4f2e0e39a53924bbd79bb9e
SSDEEP

192:qspqtJmjMScU41+HMgL8eem0PVafq2otoe014qWRUDnA7ciyw:ytJmQScb1wMg8E0PcfqzmF14PGDnR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1936	2200	rundll32.exe	30
PID 2200 wrote to memory of 1936	2200	rundll32.exe	30
PID 2200 wrote to memory of 1936	2200	rundll32.exe	30
PID 2200 wrote to memory of 1936	2200	rundll32.exe	30
PID 2200 wrote to memory of 1936	2200	rundll32.exe	30
PID 2200 wrote to memory of 1936	2200	rundll32.exe	30
PID 2200 wrote to memory of 1936	2200	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2eae3e847e7def896c3005e9dae7731e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2eae3e847e7def896c3005e9dae7731e_JaffaCakes118.dll,#1
  2⤵
  PID:1936

memory/1936-0-0x0000000005CE0000-0x0000000005CEC000-memory.dmp

Filesize
48KB

Download