4c3b6b660c93494101412f0eb08be8b6e0854574dbb31cb4c87fab8bd52fb980

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 09:45

Target

2fe0a490a2a3edb9ff62841e09713f2c_JaffaCakes118.dll
Size

25KB
MD5

2fe0a490a2a3edb9ff62841e09713f2c
SHA1

99ea83786825cb5df5eb95a2dc708a67d9053133
SHA256

4c3b6b660c93494101412f0eb08be8b6e0854574dbb31cb4c87fab8bd52fb980
SHA512

94b23a3afa4e1b119165d59ccdf7c75b50e49f3d8b626aff3f4bb6734cce740cb947b7d9fe9beb7494806d207889c79e3bbe506eb10f95d88d2a71479033fec6
SSDEEP

384:PqRUX8rexMxqz3EB9Ln1L1LzTU/0vzmY/JJO7DY0vBsisp2o:PCFqisz3Ud1L1XTUc6YTV0S

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2752	2856	rundll32.exe	30
PID 2856 wrote to memory of 2752	2856	rundll32.exe	30
PID 2856 wrote to memory of 2752	2856	rundll32.exe	30
PID 2856 wrote to memory of 2752	2856	rundll32.exe	30
PID 2856 wrote to memory of 2752	2856	rundll32.exe	30
PID 2856 wrote to memory of 2752	2856	rundll32.exe	30
PID 2856 wrote to memory of 2752	2856	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fe0a490a2a3edb9ff62841e09713f2c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fe0a490a2a3edb9ff62841e09713f2c_JaffaCakes118.dll,#1
  2⤵
  PID:2752

memory/2752-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download