25a255982d414d41122261822c32d2faff0f538988a7cc3ad33474f5a5c86940

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 05:22

Target

447ab12a4fd8aa8c6876127653458d5f_JaffaCakes118.dll
Size

118KB
MD5

447ab12a4fd8aa8c6876127653458d5f
SHA1

d0601739993b189e28e29edc980ab396902d6993
SHA256

25a255982d414d41122261822c32d2faff0f538988a7cc3ad33474f5a5c86940
SHA512

8117e6c7446df85d77aed7ba0cadb66f009a829264a71b99a9cfc9badd74f4d42dec50aff8fc34e9634494410cc722a94eb99b5d3adf13bec69f902ae1486ea0
SSDEEP

1536:mq0rvcfcgfzIcHO9cuI/Qd1oKyXKjt4mVokzQr/EzsfjEzPoYOfm2Cd:mNrvorSxqQd1oYimVaGROOtd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 3044	2480	rundll32.exe	30
PID 2480 wrote to memory of 3044	2480	rundll32.exe	30
PID 2480 wrote to memory of 3044	2480	rundll32.exe	30
PID 2480 wrote to memory of 3044	2480	rundll32.exe	30
PID 2480 wrote to memory of 3044	2480	rundll32.exe	30
PID 2480 wrote to memory of 3044	2480	rundll32.exe	30
PID 2480 wrote to memory of 3044	2480	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\447ab12a4fd8aa8c6876127653458d5f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\447ab12a4fd8aa8c6876127653458d5f_JaffaCakes118.dll,#1
  2⤵
  PID:3044

memory/3044-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download