e1ff46ec09545646d92f0b1734c7facb7429802fd476d2806dd54faccfbf4a87

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 18:15

Target

ebb1991db313bddeeb0128e6ee71e069_JaffaCakes118.dll
Size

91KB
MD5

ebb1991db313bddeeb0128e6ee71e069
SHA1

543fc364724738573abaf298139164b339521a08
SHA256

e1ff46ec09545646d92f0b1734c7facb7429802fd476d2806dd54faccfbf4a87
SHA512

07c208b99d4ce5264e4a00d7cd7c3e6b22fdb62f9ad46f76b2ae3e2f752eefa4fece57124c62550f50d8ea8aede0a84037c4a34203d12bff34c1349f2d0df973
SSDEEP

1536:XKq3hQ3BVwGfOcnJf2xqKG4IntFSr/gAi9++3Oni3b:6AkbwFWJfaxTITAj+3Oni3b

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2244	2380	rundll32.exe	28
PID 2380 wrote to memory of 2244	2380	rundll32.exe	28
PID 2380 wrote to memory of 2244	2380	rundll32.exe	28
PID 2380 wrote to memory of 2244	2380	rundll32.exe	28
PID 2380 wrote to memory of 2244	2380	rundll32.exe	28
PID 2380 wrote to memory of 2244	2380	rundll32.exe	28
PID 2380 wrote to memory of 2244	2380	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebb1991db313bddeeb0128e6ee71e069_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebb1991db313bddeeb0128e6ee71e069_JaffaCakes118.dll,#1
  2⤵
  PID:2244

memory/2244-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/2244-1-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/2244-2-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download