1f9575d813b0fe36c47749c577d7554fa8755acb4e583ed3e9ee9ae100c0da4a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 23:29

Target

61dcd9e921708ee3809cec1aac331d61_JaffaCakes118.dll
Size

572KB
MD5

61dcd9e921708ee3809cec1aac331d61
SHA1

508e298210aeab7b9d0bfec22a900d905b125d9d
SHA256

1f9575d813b0fe36c47749c577d7554fa8755acb4e583ed3e9ee9ae100c0da4a
SHA512

b225fa9fc80dc2d41bce4a6158de8f31957849cacfe55357819df34a974451fa355dbf2b54604ba84c2a335a76012e64b8895b5c6d1acd95393b174517aaf3de
SSDEEP

12288:bTLhkkQ9UXm4/tDT7V0iN21dmmBhcSKkApimZoIjOCsXptO:jakPXpB7GiN+HKHsICTtO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1960	2392	rundll32.exe	30
PID 2392 wrote to memory of 1960	2392	rundll32.exe	30
PID 2392 wrote to memory of 1960	2392	rundll32.exe	30
PID 2392 wrote to memory of 1960	2392	rundll32.exe	30
PID 2392 wrote to memory of 1960	2392	rundll32.exe	30
PID 2392 wrote to memory of 1960	2392	rundll32.exe	30
PID 2392 wrote to memory of 1960	2392	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61dcd9e921708ee3809cec1aac331d61_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\61dcd9e921708ee3809cec1aac331d61_JaffaCakes118.dll,#1
  2⤵
  PID:1960

memory/1960-0-0x00000000003B0000-0x0000000000432000-memory.dmp

Filesize
520KB

Download