fede02b6d6da93e774734573b5887607d6c76154c6db44811d3f4b762329afa0

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 04:50

Target

2f09e4884e2b55f75adbc775881a410c_JaffaCakes118.dll
Size

81KB
MD5

2f09e4884e2b55f75adbc775881a410c
SHA1

8e4dc59e8ecfa01d43f0722837e2a688581c148f
SHA256

fede02b6d6da93e774734573b5887607d6c76154c6db44811d3f4b762329afa0
SHA512

dd04d57708719d09569d1d2e97c81c6455b52588c59f730bd74fa4f83fba145549baa2f3f7662aa86454e9df97ef6ce8d9d6b88f884fdaf3041ea93a0a0d0e98
SSDEEP

1536:7B3gK9Xo7SAqKvSWEAd6B1G7ra8AAJipEMkLgwnu057T52t/8SM0:m6o9qKK1+6B1GxAZpsEGPxd50

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2804	2808	rundll32.exe	31
PID 2808 wrote to memory of 2804	2808	rundll32.exe	31
PID 2808 wrote to memory of 2804	2808	rundll32.exe	31
PID 2808 wrote to memory of 2804	2808	rundll32.exe	31
PID 2808 wrote to memory of 2804	2808	rundll32.exe	31
PID 2808 wrote to memory of 2804	2808	rundll32.exe	31
PID 2808 wrote to memory of 2804	2808	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f09e4884e2b55f75adbc775881a410c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f09e4884e2b55f75adbc775881a410c_JaffaCakes118.dll,#1
  2⤵
  PID:2804

memory/2804-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2804-1-0x00000000001C0000-0x00000000001CF000-memory.dmp

Filesize
60KB

Download