5fb6f8ddd561f718d7f3033fd076ec310a6dba7b19763b46ca337af72ef4fd29

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 03:51

Target

33331b8b71ad010e2aa79041322357ca_JaffaCakes118.dll
Size

73KB
MD5

33331b8b71ad010e2aa79041322357ca
SHA1

480c682495854c2e5eaa8d30b21743452fb5347a
SHA256

5fb6f8ddd561f718d7f3033fd076ec310a6dba7b19763b46ca337af72ef4fd29
SHA512

975326778ee731f0f2c3e9903f842723f736e29ff3916695e2375f31f969e2f4f37d7efa18fbb68d44120c6418ac0a0fe681c82afb6cc544a7e06358bfbc3061
SSDEEP

1536:bUJoi413PFIrwoIFXe3FxwCbKjWqLHVbbi0kiEAd81B/lxz:bOK13PFI+Xe3FxwTlmiJd+/lxz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2540	2536	rundll32.exe	29
PID 2536 wrote to memory of 2540	2536	rundll32.exe	29
PID 2536 wrote to memory of 2540	2536	rundll32.exe	29
PID 2536 wrote to memory of 2540	2536	rundll32.exe	29
PID 2536 wrote to memory of 2540	2536	rundll32.exe	29
PID 2536 wrote to memory of 2540	2536	rundll32.exe	29
PID 2536 wrote to memory of 2540	2536	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33331b8b71ad010e2aa79041322357ca_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33331b8b71ad010e2aa79041322357ca_JaffaCakes118.dll,#1
  2⤵
  PID:2540

memory/2540-0-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download