e8dc27c4d44b4ba09dc09ef8a284f36a5a41f6c4e49aa970316f7a6a14be3a2a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 07:03

Target

5ae9d9efb36913bf6487c6a3db91ccaf_JaffaCakes118.dll
Size

118KB
MD5

5ae9d9efb36913bf6487c6a3db91ccaf
SHA1

8ce0dc5bca9d6e376c16d2ff0f58e30f1b9abd73
SHA256

e8dc27c4d44b4ba09dc09ef8a284f36a5a41f6c4e49aa970316f7a6a14be3a2a
SHA512

c7fb7977c971a9899629bd7d446e82fe78d7e1581a6818b1bf242892ede6dbfc29b07e738618239b0081a89c05034ac3a910fc22de34ad10c3b7c4d4089a76ea
SSDEEP

3072:adngK7aidAEMG3hjHZdri+z6gBSOHZIJ5idPidfmiRDmdZ:ah77liNAviS5ZUsi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2128	2112	rundll32.exe	30
PID 2112 wrote to memory of 2128	2112	rundll32.exe	30
PID 2112 wrote to memory of 2128	2112	rundll32.exe	30
PID 2112 wrote to memory of 2128	2112	rundll32.exe	30
PID 2112 wrote to memory of 2128	2112	rundll32.exe	30
PID 2112 wrote to memory of 2128	2112	rundll32.exe	30
PID 2112 wrote to memory of 2128	2112	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ae9d9efb36913bf6487c6a3db91ccaf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ae9d9efb36913bf6487c6a3db91ccaf_JaffaCakes118.dll,#1
  2⤵
  PID:2128

memory/2128-1-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/2128-0-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download