301b95c9011407c61511a86a88648303981321554632c6565cc62acd88e3ea37

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 16:36

Target

427ce9a90d5e1516930d117b5983ef7f_JaffaCakes118.dll
Size

24KB
MD5

427ce9a90d5e1516930d117b5983ef7f
SHA1

1d714c4b55836c15665c912ff6569b628ccbf722
SHA256

301b95c9011407c61511a86a88648303981321554632c6565cc62acd88e3ea37
SHA512

da46d22dd9028ca26d16732f21feeb3c4708f2ea66b0cc02b8b97b4a7f34ba21a371042df08288eb065205541607f06ece7706e9c9cad7c1f2512cc7421ec029
SSDEEP

768:vurGkhuZJE79jnmoUF0iMMAH6DkWkrliUfJRn:Wr9huZJE79jnmoUSLKDkWkYU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2208	3024	rundll32.exe	30
PID 3024 wrote to memory of 2208	3024	rundll32.exe	30
PID 3024 wrote to memory of 2208	3024	rundll32.exe	30
PID 3024 wrote to memory of 2208	3024	rundll32.exe	30
PID 3024 wrote to memory of 2208	3024	rundll32.exe	30
PID 3024 wrote to memory of 2208	3024	rundll32.exe	30
PID 3024 wrote to memory of 2208	3024	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\427ce9a90d5e1516930d117b5983ef7f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\427ce9a90d5e1516930d117b5983ef7f_JaffaCakes118.dll,#1
  2⤵
  PID:2208

memory/2208-0-0x0000000001CA0000-0x0000000001DA0000-memory.dmp

Filesize
1024KB

Download