e0fef6e9e2fb9610a1e32780f24420d17e6f4f39de27557a319ef5df90a5bbe5

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 21:03

Target

616312b3377f5f14bda96715c8faef49_JaffaCakes118.dll
Size

273KB
MD5

616312b3377f5f14bda96715c8faef49
SHA1

575da055f24f834c4e1ff6978914dcdcd7211748
SHA256

e0fef6e9e2fb9610a1e32780f24420d17e6f4f39de27557a319ef5df90a5bbe5
SHA512

56799b6df181a8653721c6a75d173b793813d884c6dc72c5c845e8d65a0f9d895e126bc8bd8df2492856b5bcd1f00e97b7d07eec04de7d3e1bdd2a67a193549e
SSDEEP

6144:sk813XD+nz/G3PiaAKd1HfxmF6ZvPynWmo7XSsZ5V:/kR3yAMGikSG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2852	2740	rundll32.exe	30
PID 2740 wrote to memory of 2852	2740	rundll32.exe	30
PID 2740 wrote to memory of 2852	2740	rundll32.exe	30
PID 2740 wrote to memory of 2852	2740	rundll32.exe	30
PID 2740 wrote to memory of 2852	2740	rundll32.exe	30
PID 2740 wrote to memory of 2852	2740	rundll32.exe	30
PID 2740 wrote to memory of 2852	2740	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\616312b3377f5f14bda96715c8faef49_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\616312b3377f5f14bda96715c8faef49_JaffaCakes118.dll,#1
  2⤵
  PID:2852

memory/2852-0-0x0000000010000000-0x00000000100A6000-memory.dmp

Filesize
664KB

Download