1b5b1dee909a80ee86e9468d872abcfdb6344fea43108405c0b8fdfe6ebd2da3

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 06:05

Target

2f3dc56db5ea5739ab4923aa378e8a7e_JaffaCakes118.dll
Size

2.1MB
MD5

2f3dc56db5ea5739ab4923aa378e8a7e
SHA1

2951a56a5dae987882f2e8b967650a677c8187e4
SHA256

1b5b1dee909a80ee86e9468d872abcfdb6344fea43108405c0b8fdfe6ebd2da3
SHA512

71f63ea5e7393a4ebe11c4a76ade7d56e3c838349542e4e57969c581c91f31b780d0f12cb489766cb1feb5183ba70f720b5a9855ec67ba726e3fbebe86d84052
SSDEEP

49152:ZHHY4L2q5HkL+eUYWHsiJNXvkUKm/FPdGuHCGeQCAqXoZWHn:lV9HkAVHL/DKmFfCVQ4H

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2988	2328	rundll32.exe	30
PID 2328 wrote to memory of 2988	2328	rundll32.exe	30
PID 2328 wrote to memory of 2988	2328	rundll32.exe	30
PID 2328 wrote to memory of 2988	2328	rundll32.exe	30
PID 2328 wrote to memory of 2988	2328	rundll32.exe	30
PID 2328 wrote to memory of 2988	2328	rundll32.exe	30
PID 2328 wrote to memory of 2988	2328	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f3dc56db5ea5739ab4923aa378e8a7e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f3dc56db5ea5739ab4923aa378e8a7e_JaffaCakes118.dll,#1
  2⤵
  PID:2988

memory/2988-0-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download