52bd121e2fca532818ffbc09430214e2261af0bf7c698234c06f05b9ca22dd0c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 19:53

Target

431dcb7d11c926e377b24cfc5da41ac6_JaffaCakes118.dll
Size

48KB
MD5

431dcb7d11c926e377b24cfc5da41ac6
SHA1

718da9625f90579de4bbf293d56a54b3d9af163e
SHA256

52bd121e2fca532818ffbc09430214e2261af0bf7c698234c06f05b9ca22dd0c
SHA512

a846770e16d14442945737f884217fe54fa0d99b76bc14e027a215935548f7c6ede20151397f7401c92c771fc177f0ef776ac6e431d97e465ca272ae871bda22
SSDEEP

768:ahc40A5vPJ77HsbebogDDIha5hZUqsVSzb1j9EkPfYxzUgGar+DSa119U2g0GrPC:akEvx77HsbeEgDDI4/ZUq9fljfYx0TDh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1868	2112	rundll32.exe	30
PID 2112 wrote to memory of 1868	2112	rundll32.exe	30
PID 2112 wrote to memory of 1868	2112	rundll32.exe	30
PID 2112 wrote to memory of 1868	2112	rundll32.exe	30
PID 2112 wrote to memory of 1868	2112	rundll32.exe	30
PID 2112 wrote to memory of 1868	2112	rundll32.exe	30
PID 2112 wrote to memory of 1868	2112	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\431dcb7d11c926e377b24cfc5da41ac6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\431dcb7d11c926e377b24cfc5da41ac6_JaffaCakes118.dll,#1
  2⤵
  PID:1868

memory/1868-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download