90240e2869f3afada472da3781fc4e19b15e75b5e50fe1a63caf19d6f2a52ec9

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 11:43

Target

ed572dd733ce79ea5a4545491aae19f4_JaffaCakes118.dll
Size

420KB
MD5

ed572dd733ce79ea5a4545491aae19f4
SHA1

6c93bd436929afc4aa5204bcc0f3236273828ade
SHA256

90240e2869f3afada472da3781fc4e19b15e75b5e50fe1a63caf19d6f2a52ec9
SHA512

be7377d7587f3d7067d469bb06933bdeb5bf79e2c15fad76844374635436c36eaaf402504c1a70229d3d05682b344ad7a4e2177df1b72a803e55d1c0cb768001
SSDEEP

6144:4UryYkXSmckr4MszVkTdAPwbiXR8xZg3OSr84Dpx6HiNm:4URkr4MMWdwfXR8x+nr8YcHio

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1460	2088	rundll32.exe	28
PID 2088 wrote to memory of 1460	2088	rundll32.exe	28
PID 2088 wrote to memory of 1460	2088	rundll32.exe	28
PID 2088 wrote to memory of 1460	2088	rundll32.exe	28
PID 2088 wrote to memory of 1460	2088	rundll32.exe	28
PID 2088 wrote to memory of 1460	2088	rundll32.exe	28
PID 2088 wrote to memory of 1460	2088	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed572dd733ce79ea5a4545491aae19f4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed572dd733ce79ea5a4545491aae19f4_JaffaCakes118.dll,#1
  2⤵
  PID:1460

memory/1460-0-0x0000000000300000-0x0000000000374000-memory.dmp

Filesize
464KB

Download
memory/1460-1-0x0000000000300000-0x0000000000374000-memory.dmp

Filesize
464KB

Download
memory/1460-2-0x0000000000300000-0x0000000000374000-memory.dmp

Filesize
464KB

Download
memory/1460-3-0x0000000000300000-0x0000000000374000-memory.dmp

Filesize
464KB

Download
memory/1460-4-0x0000000000300000-0x0000000000374000-memory.dmp

Filesize
464KB

Download
memory/1460-5-0x0000000000500000-0x0000000000563000-memory.dmp

Filesize
396KB

Download
memory/1460-6-0x0000000000290000-0x00000000002B8000-memory.dmp

Filesize
160KB

Download