eba98aa4a642273d90d069477c73e3d019145a7a648255c9c55a95b9df08d648

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 16:56

Target

313758a18fe509058f210ae76ca626c8_JaffaCakes118.dll
Size

206KB
MD5

313758a18fe509058f210ae76ca626c8
SHA1

705bcf7d46948a7a5beb744c79e5a60fe458b853
SHA256

eba98aa4a642273d90d069477c73e3d019145a7a648255c9c55a95b9df08d648
SHA512

b1e62a2313d54ca9760e380b0c49495d9f9c7ef59174ce99b8d941eeedb586bec31bf36aa8a055eb58fcc626208d9382569a67edd2b31b15f92f0a2cc2d6c6b0
SSDEEP

6144:BXYNfqLi50ZdoeFPgVCAH2yDPRK0kED1Fn2rFWfHaGyUHE:sCLzPoeNg0ARDJoED1Fn2rFsvyUHE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2800	2292	rundll32.exe	30
PID 2292 wrote to memory of 2800	2292	rundll32.exe	30
PID 2292 wrote to memory of 2800	2292	rundll32.exe	30
PID 2292 wrote to memory of 2800	2292	rundll32.exe	30
PID 2292 wrote to memory of 2800	2292	rundll32.exe	30
PID 2292 wrote to memory of 2800	2292	rundll32.exe	30
PID 2292 wrote to memory of 2800	2292	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\313758a18fe509058f210ae76ca626c8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\313758a18fe509058f210ae76ca626c8_JaffaCakes118.dll,#1
  2⤵
  PID:2800

memory/2800-0-0x00000000754B0000-0x0000000075535000-memory.dmp

Filesize
532KB

Download
memory/2800-1-0x0000000075420000-0x00000000754A5000-memory.dmp

Filesize
532KB

Download