453db5c09c33f5f1ce24ab46ea17b13444ccb0bc3505932d9023c9b48c8ced65

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 01:06

Target

372190d18d8449ae34f820e28a0e4dc0_JaffaCakes118.dll
Size

25KB
MD5

372190d18d8449ae34f820e28a0e4dc0
SHA1

a3c7cfcbb78b626a96a73746b73a1e57d2553e09
SHA256

453db5c09c33f5f1ce24ab46ea17b13444ccb0bc3505932d9023c9b48c8ced65
SHA512

0afa4ee824439e42c0c3d76a091a5404e570707aae553e69827ed30ceeea494db7918ba68fc2ea1a0e01e2deff90508a689d8fb30c6b4aeedea257132e217685
SSDEEP

768:rxmWnNKqJgEd4wRejWPYBZs1ijS2lq31x:rxmWNHJR4QeckXjS2li1x

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1852	1048	rundll32.exe	29
PID 1048 wrote to memory of 1852	1048	rundll32.exe	29
PID 1048 wrote to memory of 1852	1048	rundll32.exe	29
PID 1048 wrote to memory of 1852	1048	rundll32.exe	29
PID 1048 wrote to memory of 1852	1048	rundll32.exe	29
PID 1048 wrote to memory of 1852	1048	rundll32.exe	29
PID 1048 wrote to memory of 1852	1048	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\372190d18d8449ae34f820e28a0e4dc0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\372190d18d8449ae34f820e28a0e4dc0_JaffaCakes118.dll,#1
  2⤵
  PID:1852

memory/1852-0-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download