dffe033eaa04e02ba1c1cd43dc305ab65ddf8c6fca15899c935c8d7d2390f305

Analysis

max time kernel
10s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 20:54

Target

64c51d2a6b234fafd81ac73194775898_JaffaCakes118.dll
Size

73KB
MD5

64c51d2a6b234fafd81ac73194775898
SHA1

89394a6ebb475074c3d30ca497eb4343b5c328d3
SHA256

dffe033eaa04e02ba1c1cd43dc305ab65ddf8c6fca15899c935c8d7d2390f305
SHA512

790745182431006426b103ed1cfe02a063c716ab8fe8694c2ad1cde902e73e32c6d9a03b63f8da2f2f7fba334bb8e009cae136fcb8be2c0fa445250d89c35624
SSDEEP

768:h+Niuj+0sY9zFeF98GVBDS1gAfCG+vn45:hO+0smz8F9rS1rf+PA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2140	3012	rundll32.exe	29
PID 3012 wrote to memory of 2140	3012	rundll32.exe	29
PID 3012 wrote to memory of 2140	3012	rundll32.exe	29
PID 3012 wrote to memory of 2140	3012	rundll32.exe	29
PID 3012 wrote to memory of 2140	3012	rundll32.exe	29
PID 3012 wrote to memory of 2140	3012	rundll32.exe	29
PID 3012 wrote to memory of 2140	3012	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64c51d2a6b234fafd81ac73194775898_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64c51d2a6b234fafd81ac73194775898_JaffaCakes118.dll,#1
  2⤵
  PID:2140

memory/2140-0-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download