624907f58e7450d71ca57244aa1a2b3edb1bf4e4e6a01181e9f9c54cb156c48d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 18:33

Target

31803ee7d89e32d9974b961807f9575e_JaffaCakes118.dll
Size

72KB
MD5

31803ee7d89e32d9974b961807f9575e
SHA1

c77facb12f046a571fba7fc9e0b65936c65435a8
SHA256

624907f58e7450d71ca57244aa1a2b3edb1bf4e4e6a01181e9f9c54cb156c48d
SHA512

49bf8ee41bb10817017d249afdfe3995c3f66516ca47107fa8646223ec92a4b476b9b4b7a3c670d54a8194c33aa5f8f87fffba6b1dcaaefea288f2f225b15902
SSDEEP

1536:HgshApj0X4Lm+0VgYI9Rl3sInloSRlx2FfIm+8X9R+OgMN/rsTAmvlIBdBnlX:AsRILm/gv9RrLx2FfI78X9RQMNz4Amvw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2948	2116	rundll32.exe	30
PID 2116 wrote to memory of 2948	2116	rundll32.exe	30
PID 2116 wrote to memory of 2948	2116	rundll32.exe	30
PID 2116 wrote to memory of 2948	2116	rundll32.exe	30
PID 2116 wrote to memory of 2948	2116	rundll32.exe	30
PID 2116 wrote to memory of 2948	2116	rundll32.exe	30
PID 2116 wrote to memory of 2948	2116	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31803ee7d89e32d9974b961807f9575e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31803ee7d89e32d9974b961807f9575e_JaffaCakes118.dll,#1
  2⤵
  PID:2948

memory/2948-0-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download