9d76a446bb028a91b08c9e207dc8cad9cee8cbcac28c76df740b64be8a2eb027

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 07:59

Target

5fa9865633b82897f5f3d1b57a4eb432_JaffaCakes118.dll
Size

82KB
MD5

5fa9865633b82897f5f3d1b57a4eb432
SHA1

2ff46e5c6f298961998f88361741b75e37f41713
SHA256

9d76a446bb028a91b08c9e207dc8cad9cee8cbcac28c76df740b64be8a2eb027
SHA512

acbe29dae953916b5b8aa61a35483e15e23bf63caf398201f252545a8d500ba0eeb28189883dadfafeeb85867b33036ac27ca538e03ea80fe746644097af546e
SSDEEP

1536:VwBMhOAKqFCt9GqITUXvrIBG12qwFaUiVJvUGdRlxOAshXHOJD4pv6:mBMhpJCNrvkBO0F3qx0m

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 1892	2316	rundll32.exe	31
PID 2316 wrote to memory of 1892	2316	rundll32.exe	31
PID 2316 wrote to memory of 1892	2316	rundll32.exe	31
PID 2316 wrote to memory of 1892	2316	rundll32.exe	31
PID 2316 wrote to memory of 1892	2316	rundll32.exe	31
PID 2316 wrote to memory of 1892	2316	rundll32.exe	31
PID 2316 wrote to memory of 1892	2316	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fa9865633b82897f5f3d1b57a4eb432_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fa9865633b82897f5f3d1b57a4eb432_JaffaCakes118.dll,#1
  2⤵
  PID:1892

memory/1892-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1892-1-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1892-2-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download