c9b4685185e0f998c9389bb1756c5e741c21cbbbce78fd33b0c4d44b49de5f5e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 15:08

Target

4232fca300d7e37eaccf990a40fe9c83_JaffaCakes118.dll
Size

244KB
MD5

4232fca300d7e37eaccf990a40fe9c83
SHA1

227e5ed419498f04f27bc0840f0134e74a22e826
SHA256

c9b4685185e0f998c9389bb1756c5e741c21cbbbce78fd33b0c4d44b49de5f5e
SHA512

eefabdbc62fc1eb2db001ae525516dccf8226abf4f43d5b114dfe8cc31c46b920c69bb9a5594c65bee20ae35e41cbd1d00ce07738084c906abcf2e25caf6755a
SSDEEP

6144:a6Ib0YtxWuar6klk+bLOsbzSjlsyhGOotpd0rFOYn:Mb0YtUuKxkmisbzSpsyhM4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2120	2116	rundll32.exe	30
PID 2116 wrote to memory of 2120	2116	rundll32.exe	30
PID 2116 wrote to memory of 2120	2116	rundll32.exe	30
PID 2116 wrote to memory of 2120	2116	rundll32.exe	30
PID 2116 wrote to memory of 2120	2116	rundll32.exe	30
PID 2116 wrote to memory of 2120	2116	rundll32.exe	30
PID 2116 wrote to memory of 2120	2116	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4232fca300d7e37eaccf990a40fe9c83_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4232fca300d7e37eaccf990a40fe9c83_JaffaCakes118.dll,#1
  2⤵
  PID:2120

memory/2120-0-0x0000000010000000-0x00000000100F4000-memory.dmp

Filesize
976KB

Download