bdf121f921bf1a94af9a06cf4b7755b1d9a291de3e27cc111243591d85c5e2d6

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 15:51

Target

4a59d3a7976e46884d5e80c780598f03_JaffaCakes118.dll
Size

25KB
MD5

4a59d3a7976e46884d5e80c780598f03
SHA1

6fb43e2ae838e065e91c01fae04bfaa35e02ad5f
SHA256

bdf121f921bf1a94af9a06cf4b7755b1d9a291de3e27cc111243591d85c5e2d6
SHA512

b1d401bc0b8604297c4ff7bf2a372f6f9889052d8b5ddf1c7d0bfad3ee607b31d972ae8bc013d66378beae0a38be404c59e096ce36c0f577b1d4b9234912e492
SSDEEP

384:6Fq8kSCOk7cRodTeC1ZkefDKXl87JHgxS4T1+:Qq8MZndTeC9KVqJHgxB1+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1800	1604	rundll32.exe	28
PID 1604 wrote to memory of 1800	1604	rundll32.exe	28
PID 1604 wrote to memory of 1800	1604	rundll32.exe	28
PID 1604 wrote to memory of 1800	1604	rundll32.exe	28
PID 1604 wrote to memory of 1800	1604	rundll32.exe	28
PID 1604 wrote to memory of 1800	1604	rundll32.exe	28
PID 1604 wrote to memory of 1800	1604	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a59d3a7976e46884d5e80c780598f03_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a59d3a7976e46884d5e80c780598f03_JaffaCakes118.dll,#1
  2⤵
  PID:1800

memory/1800-1-0x0000000065C80000-0x0000000065C8D000-memory.dmp

Filesize
52KB

Download