0a9e81f1d8b0810e0f8733c180125b8720e29d926923dc6ff50799d578da4346

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 14:22

Target

5c4f7595b73608f2fe3bba06746ece08_JaffaCakes118.dll
Size

61KB
MD5

5c4f7595b73608f2fe3bba06746ece08
SHA1

be85cd0613418cae9a560942eccdf33086596309
SHA256

0a9e81f1d8b0810e0f8733c180125b8720e29d926923dc6ff50799d578da4346
SHA512

5f5536f8efa3059cbad492f009e1ec11e3dcfd04c4da9c2091e196bd3dac690e210b0a0bab4d2989b34acb0f8b726d737b52cf455099f1ed9a78f1ec6fbff3e5
SSDEEP

1536:ZpVa+oRDy8H8UupEHG2+Ld7d370jQgr4hf4H:ZpVaNRDy8HPupEHLCdpAUg8hf4H

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1928	1380	rundll32.exe	30
PID 1380 wrote to memory of 1928	1380	rundll32.exe	30
PID 1380 wrote to memory of 1928	1380	rundll32.exe	30
PID 1380 wrote to memory of 1928	1380	rundll32.exe	30
PID 1380 wrote to memory of 1928	1380	rundll32.exe	30
PID 1380 wrote to memory of 1928	1380	rundll32.exe	30
PID 1380 wrote to memory of 1928	1380	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c4f7595b73608f2fe3bba06746ece08_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c4f7595b73608f2fe3bba06746ece08_JaffaCakes118.dll,#1
  2⤵
  PID:1928

memory/1928-0-0x0000000000290000-0x000000000031C000-memory.dmp

Filesize
560KB

Download