17492a7ec92f3714983c89ff6565294d680e4283499369ab76a92eec56ca3be1

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 12:48

Target

34c92220fad01778eb768ba25979d420_JaffaCakes118.dll
Size

33KB
MD5

34c92220fad01778eb768ba25979d420
SHA1

885f5dd91862bf8dcee18ff026c6d0cff4db7875
SHA256

17492a7ec92f3714983c89ff6565294d680e4283499369ab76a92eec56ca3be1
SHA512

3ed3026226a99c9e06dfc9f2d9460c66c5bd3964323b8abe35a4417381c77200bd44c4ac0427ed60575ec4505ae9176bd7b6bc94400ee2d807a0500a8ef9b6f5
SSDEEP

384:pI4xxXNWM07WEnX4kDGDykI9K3xL9pL7ysp8DDzdy3u37upF+L6DdQRkkyk0RRa2:ZjEZwy1+Pv1pWDhy67uTlDdQWtMY4MJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 468	1828	rundll32.exe	31
PID 1828 wrote to memory of 468	1828	rundll32.exe	31
PID 1828 wrote to memory of 468	1828	rundll32.exe	31
PID 1828 wrote to memory of 468	1828	rundll32.exe	31
PID 1828 wrote to memory of 468	1828	rundll32.exe	31
PID 1828 wrote to memory of 468	1828	rundll32.exe	31
PID 1828 wrote to memory of 468	1828	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\34c92220fad01778eb768ba25979d420_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\34c92220fad01778eb768ba25979d420_JaffaCakes118.dll,#1
  2⤵
  PID:468

memory/468-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download