b4dc8a27fb92720565f4d0aa6254370e50b19ec586526118fd1c2574d4221944

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 17:31

Target

5cf20044faec1d71b713c2f7816a6c20_JaffaCakes118.dll
Size

35KB
MD5

5cf20044faec1d71b713c2f7816a6c20
SHA1

86687389a638000022abfeaf8dc7bd4a2522782b
SHA256

b4dc8a27fb92720565f4d0aa6254370e50b19ec586526118fd1c2574d4221944
SHA512

7e4e1dae8703f411deae43d1dc697d888d3ca7a013915843c6c68c5cdc6878df5d8e676f8ad43091a51e940125cdb997b95334c02ab4f78d80018394f4f9f5e0
SSDEEP

384:OOzakryyly8156/dasxuPKKAya0A8iYYv+WOZ5EaO9G00lX0D4doDHS3z4oCy7E0:ds81AwPVa0dR8/3hs00llos76/yvGh0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 840	1748	rundll32.exe	30
PID 1748 wrote to memory of 840	1748	rundll32.exe	30
PID 1748 wrote to memory of 840	1748	rundll32.exe	30
PID 1748 wrote to memory of 840	1748	rundll32.exe	30
PID 1748 wrote to memory of 840	1748	rundll32.exe	30
PID 1748 wrote to memory of 840	1748	rundll32.exe	30
PID 1748 wrote to memory of 840	1748	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cf20044faec1d71b713c2f7816a6c20_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cf20044faec1d71b713c2f7816a6c20_JaffaCakes118.dll,#1
  2⤵
  PID:840

memory/840-0-0x0000000000240000-0x000000000024F000-memory.dmp

Filesize
60KB

Download