72bc8fe90c32c6fa087c5277276122763a43776c5992ee5a6782d382035250b5

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 22:54

Target

4721f4eaae10f870585a01ee9c58abc6_JaffaCakes118.dll
Size

29KB
MD5

4721f4eaae10f870585a01ee9c58abc6
SHA1

1f699b4719a532082954a40ad502664167de0fb1
SHA256

72bc8fe90c32c6fa087c5277276122763a43776c5992ee5a6782d382035250b5
SHA512

48c1c843cbf13b2d1b8c9e69f8ab6d4787bf251dd2c29cba9edb8d7a4b283c309b913f384ea1be77721ebfb7fea99dc465c8d1b70399c9d9856ab1c42c13e643
SSDEEP

192:UP8OZb+4+GAPYpViCeD+tcD3uBBQ6PRQkirW3UwBB1jf:Sbb+PGAPYHKyauBBQARQkoW3UwXF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 816	552	rundll32.exe	31
PID 552 wrote to memory of 816	552	rundll32.exe	31
PID 552 wrote to memory of 816	552	rundll32.exe	31
PID 552 wrote to memory of 816	552	rundll32.exe	31
PID 552 wrote to memory of 816	552	rundll32.exe	31
PID 552 wrote to memory of 816	552	rundll32.exe	31
PID 552 wrote to memory of 816	552	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4721f4eaae10f870585a01ee9c58abc6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4721f4eaae10f870585a01ee9c58abc6_JaffaCakes118.dll,#1
  2⤵
  PID:816

memory/816-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download