17a6a3f2913b2a25107e89cd8962521402c6743c1ca56777a4566efc30082aaf

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 00:31

Target

3b533ea5b6a804a2a049c9f6c314c3c9_JaffaCakes118.dll
Size

25KB
MD5

3b533ea5b6a804a2a049c9f6c314c3c9
SHA1

f66b87fdb6a454affda0e836df3f2a9cb4f77e24
SHA256

17a6a3f2913b2a25107e89cd8962521402c6743c1ca56777a4566efc30082aaf
SHA512

db96720f156ea978a20c166cc5eb2a14afb65774ddf851ac85a5294d05cb94a94e511c4ba324a4fdc0cfabb68e3b055d9f3352e7ce93072cedda985695ba1a1c
SSDEEP

384:n5ErhIgja3Ye/IrNXFxMPxXsjhaC7ftTOMv02TQgYCzyX6/pG2DRoO:lr3YEIJ1xMWdaCRlZTJDWXapG2DqO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2956	2256	rundll32.exe	30
PID 2256 wrote to memory of 2956	2256	rundll32.exe	30
PID 2256 wrote to memory of 2956	2256	rundll32.exe	30
PID 2256 wrote to memory of 2956	2256	rundll32.exe	30
PID 2256 wrote to memory of 2956	2256	rundll32.exe	30
PID 2256 wrote to memory of 2956	2256	rundll32.exe	30
PID 2256 wrote to memory of 2956	2256	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b533ea5b6a804a2a049c9f6c314c3c9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b533ea5b6a804a2a049c9f6c314c3c9_JaffaCakes118.dll,#1
  2⤵
  PID:2956

memory/2956-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download