19053383fb0a5f670d54078eda5d6a8f7c86a49d1ac8462310b155c882cee725

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 04:20

Target

44489959b54a5dd16e7b01c29228e3cc_JaffaCakes118.dll
Size

379KB
MD5

44489959b54a5dd16e7b01c29228e3cc
SHA1

222388c888b612d7228d0229d78e31603817ad5d
SHA256

19053383fb0a5f670d54078eda5d6a8f7c86a49d1ac8462310b155c882cee725
SHA512

d85fc09a4d68b406c49e48546a2a3ed7815117dfd11b5bc7256560d4b8b1f743e10790c5583c55334ff9753fa4f5227b00f9a95f85232db5a7a3cc7ed7237b63
SSDEEP

6144:yv47iJLaFvft7sBGnXjxAXmxCx2LYW2Tz0tfT+zSyrBwsQXF4MbshSylNcyPuBRr:82RQTzXA1KlwD3MjfP/y

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44489959b54a5dd16e7b01c29228e3cc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44489959b54a5dd16e7b01c29228e3cc_JaffaCakes118.dll,#1
  2⤵
  PID:2508

memory/2508-0-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download