6033322a9da7db8282cd9602bd1aee1ca8f5cdc2ce0afecc0222849ce6793c87

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 00:26

Target

32990fc7ef82f24a56dc0d263618a102_JaffaCakes118.dll
Size

307KB
MD5

32990fc7ef82f24a56dc0d263618a102
SHA1

9748866ba26d76d11cb46667fb4fcf84d770bf3c
SHA256

6033322a9da7db8282cd9602bd1aee1ca8f5cdc2ce0afecc0222849ce6793c87
SHA512

f444e037b82c123efb6da3f42b7537993cb5485d3c031c23cb06120d78b81420c4ad85d9c5a52a513e5f50ffbd18117ce8eb01dea1dbc4895bea28fba3258049
SSDEEP

6144:m+FLMJGJnjOy5HIY74Socz7uH2KnFYZYY40+aLXRvl2OhpbifnZglGi:maLMaOy5oY7LlziH2zm0R5gOh5YZgz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2860	2700	rundll32.exe	30
PID 2700 wrote to memory of 2860	2700	rundll32.exe	30
PID 2700 wrote to memory of 2860	2700	rundll32.exe	30
PID 2700 wrote to memory of 2860	2700	rundll32.exe	30
PID 2700 wrote to memory of 2860	2700	rundll32.exe	30
PID 2700 wrote to memory of 2860	2700	rundll32.exe	30
PID 2700 wrote to memory of 2860	2700	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32990fc7ef82f24a56dc0d263618a102_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32990fc7ef82f24a56dc0d263618a102_JaffaCakes118.dll,#1
  2⤵
  PID:2860

memory/2860-0-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download