18eab5334d46c535651f5d788e4fecd332f565deca28989fdf82e329e905f238

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 01:31

Target

47a89a58264022eb1727594c6c1ee06c_JaffaCakes118.dll
Size

689KB
MD5

47a89a58264022eb1727594c6c1ee06c
SHA1

3eeb267fb26b143d83f15eaab0d5ccea63d87cc9
SHA256

18eab5334d46c535651f5d788e4fecd332f565deca28989fdf82e329e905f238
SHA512

6129ec64bdb5b7c3fd555982fefee0bdb6ab7dc21d7cf8d29908047782e108d3e8371bc7c5142f58a23e9bf78689ac5ec083fb4e6e27450f0b9e83d0fcfa0081
SSDEEP

12288:z3rZrvHMa4S6BRggwhFX66MXjptMaPXJg4APb3Gz9aAEp/WovYJkjwH:7trvHMVS6B8hcX7MgO5bU9eEeM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 3064	1076	rundll32.exe	30
PID 1076 wrote to memory of 3064	1076	rundll32.exe	30
PID 1076 wrote to memory of 3064	1076	rundll32.exe	30
PID 1076 wrote to memory of 3064	1076	rundll32.exe	30
PID 1076 wrote to memory of 3064	1076	rundll32.exe	30
PID 1076 wrote to memory of 3064	1076	rundll32.exe	30
PID 1076 wrote to memory of 3064	1076	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47a89a58264022eb1727594c6c1ee06c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47a89a58264022eb1727594c6c1ee06c_JaffaCakes118.dll,#1
  2⤵
  PID:3064

memory/3064-0-0x0000000010000000-0x000000001002B000-memory.dmp

Filesize
172KB

Download