5a19a7474befe03e21f4017b8b9a77a8ce36fde4498422cb749babb2715e7f61

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 21:27

Target

3ef1c72ca32ec9bddcbd4804880de58c_JaffaCakes118.dll
Size

6KB
MD5

3ef1c72ca32ec9bddcbd4804880de58c
SHA1

d0c01d5834ca8cc3c5609cb1c1e3b29df8f622a2
SHA256

5a19a7474befe03e21f4017b8b9a77a8ce36fde4498422cb749babb2715e7f61
SHA512

8d28e218c6357f0f1d647e945c38e912be3b953e7bce891951c9fcb8556ea740324f524d0d433d9c079a1762425c6b5c9b5555cc3cf1cceda6c4a9ffefa62ef5
SSDEEP

96:eMlg7pPS1XfDJc0TKQpdWbG1/A6nYe8PlJDb:Popqh9HTKgnhYe87P

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2840	2864	rundll32.exe	30
PID 2864 wrote to memory of 2840	2864	rundll32.exe	30
PID 2864 wrote to memory of 2840	2864	rundll32.exe	30
PID 2864 wrote to memory of 2840	2864	rundll32.exe	30
PID 2864 wrote to memory of 2840	2864	rundll32.exe	30
PID 2864 wrote to memory of 2840	2864	rundll32.exe	30
PID 2864 wrote to memory of 2840	2864	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef1c72ca32ec9bddcbd4804880de58c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef1c72ca32ec9bddcbd4804880de58c_JaffaCakes118.dll,#1
  2⤵
  PID:2840

memory/2840-0-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download