ad07f0bc934d90322e44a261c3b062cfede77c3a7f4913d51a78dd9436d29b79

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 21:24

Target

4365bf4b9b13356a58afde1d161742d7_JaffaCakes118.dll
Size

83KB
MD5

4365bf4b9b13356a58afde1d161742d7
SHA1

cbcca7255daf85b51ec87c99503a2b31e85aa84e
SHA256

ad07f0bc934d90322e44a261c3b062cfede77c3a7f4913d51a78dd9436d29b79
SHA512

73fc5ff6b79b954889c9b4aeab2c640351a65d66ec5fe536603443d20f860e55a1e385e9867c4715336c611507ebd282a74672f0c2d885ed45c461f1db99ccc4
SSDEEP

1536:pL+sGD81j+U6abMt4bERgmLwJGpGGClbvNxIyQFWj8cKnP6:vGW6LbGmLKGg/lb7YoZKP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 3056	3044	rundll32.exe	29
PID 3044 wrote to memory of 3056	3044	rundll32.exe	29
PID 3044 wrote to memory of 3056	3044	rundll32.exe	29
PID 3044 wrote to memory of 3056	3044	rundll32.exe	29
PID 3044 wrote to memory of 3056	3044	rundll32.exe	29
PID 3044 wrote to memory of 3056	3044	rundll32.exe	29
PID 3044 wrote to memory of 3056	3044	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4365bf4b9b13356a58afde1d161742d7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4365bf4b9b13356a58afde1d161742d7_JaffaCakes118.dll,#1
  2⤵
  PID:3056

memory/3056-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download