2a96c2a6ed9a48cc7b18d522831666755be451cdedbd4755dd0902f1e4264667

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 04:56

Target

046ba358de03da88c28da302c2895515_JaffaCakes118.dll
Size

61KB
MD5

046ba358de03da88c28da302c2895515
SHA1

bea50a1af76739f5518876d22efb857bea69583c
SHA256

2a96c2a6ed9a48cc7b18d522831666755be451cdedbd4755dd0902f1e4264667
SHA512

213b89f682ef9b6aca81a05c128edd1434b96c476905bbfb6b8459c5de41c265bb753b5e8aa8c456352e1ef7c10cb8afb0ace697fd1e353cb8add095f2ce271c
SSDEEP

1536:NXc93Xmz6DcA4RsuEx5tqRxPuCOWUc1e6:NXk3Xs6DcA4RsuSSluCKmB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 1248	2996	rundll32.exe	28
PID 2996 wrote to memory of 1248	2996	rundll32.exe	28
PID 2996 wrote to memory of 1248	2996	rundll32.exe	28
PID 2996 wrote to memory of 1248	2996	rundll32.exe	28
PID 2996 wrote to memory of 1248	2996	rundll32.exe	28
PID 2996 wrote to memory of 1248	2996	rundll32.exe	28
PID 2996 wrote to memory of 1248	2996	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\046ba358de03da88c28da302c2895515_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\046ba358de03da88c28da302c2895515_JaffaCakes118.dll,#1
  2⤵
  PID:1248

memory/1248-1-0x000000006C380000-0x000000006C39F000-memory.dmp

Filesize
124KB

Download
memory/1248-3-0x000000006C380000-0x000000006C39F000-memory.dmp

Filesize
124KB

Download
memory/1248-0-0x000000006C380000-0x000000006C39F000-memory.dmp

Filesize
124KB

Download
memory/1248-2-0x000000006C380000-0x000000006C39F000-memory.dmp

Filesize
124KB

Download