4bf6512cbd674c19e06a38e54da1619e00be36360e44ffcc6a9c0ee7840aaaa2

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 14:55

Target

35321b50c06b93c525a33fa2ca188ad1_JaffaCakes118.dll
Size

37KB
MD5

35321b50c06b93c525a33fa2ca188ad1
SHA1

c660e79fe6b4e9f9a21ff3a9bbe8493c0501b2d7
SHA256

4bf6512cbd674c19e06a38e54da1619e00be36360e44ffcc6a9c0ee7840aaaa2
SHA512

62e99ce6bdb92da407456ee5b15c6ff06ffe16280f2709f4015192dc611cbfd081af11dcfdd0adb92f17ba8b3e92b9837541812ebc87e41949e60e2c083996ba
SSDEEP

384:smm13gRi3pt3Z1vlNy8IhM7ie+53H2W1V8yc9cz94JH4oQ2+tss+t57Z7d8:Igcn3Z1vfy8OM7GB1YcvP2VsCZ7d

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 2276	1772	rundll32.exe	29
PID 1772 wrote to memory of 2276	1772	rundll32.exe	29
PID 1772 wrote to memory of 2276	1772	rundll32.exe	29
PID 1772 wrote to memory of 2276	1772	rundll32.exe	29
PID 1772 wrote to memory of 2276	1772	rundll32.exe	29
PID 1772 wrote to memory of 2276	1772	rundll32.exe	29
PID 1772 wrote to memory of 2276	1772	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35321b50c06b93c525a33fa2ca188ad1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\35321b50c06b93c525a33fa2ca188ad1_JaffaCakes118.dll,#1
  2⤵
  PID:2276

memory/2276-0-0x0000000010000000-0x0000000010072000-memory.dmp

Filesize
456KB

Download