a8e91740acd8d7030090e6ebbed10aaac9dadf525ac3e1882c887115c2ed3299

Analysis

max time kernel
14s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 10:13

Target

2ff53ca2d7fd13717b1abdfacb7d2fce_JaffaCakes118.dll
Size

45KB
MD5

2ff53ca2d7fd13717b1abdfacb7d2fce
SHA1

c6aec93f6711470df638d6a58e1eab018e155c54
SHA256

a8e91740acd8d7030090e6ebbed10aaac9dadf525ac3e1882c887115c2ed3299
SHA512

db78077b9fdb56b38edc361b1c1ac5b59390dcbd8d3cc5d27e98fd3cc8aa47c09164d26ae3567027c286eb0f9054b54b86b30ee6508becc5f1fa5136c0b187c2
SSDEEP

768:+cbYhtNqXhPOa5PSayB7CDweXAa1Q8jwFzM8fHPf4BPfQO0P+SOxofEQXo93:+dhtERPOgPStBk3BnWHH4BHnwNE4o

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2024	1932	rundll32.exe	30
PID 1932 wrote to memory of 2024	1932	rundll32.exe	30
PID 1932 wrote to memory of 2024	1932	rundll32.exe	30
PID 1932 wrote to memory of 2024	1932	rundll32.exe	30
PID 1932 wrote to memory of 2024	1932	rundll32.exe	30
PID 1932 wrote to memory of 2024	1932	rundll32.exe	30
PID 1932 wrote to memory of 2024	1932	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ff53ca2d7fd13717b1abdfacb7d2fce_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ff53ca2d7fd13717b1abdfacb7d2fce_JaffaCakes118.dll,#1
  2⤵
  PID:2024

memory/2024-0-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download