6ac6c7054e275fd372d56b1466d9abed6da20a882993a69d60b547b05a4e7986

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 11:35

Target

177c827306130a526c61b6bae68545d6_JaffaCakes118.dll
Size

26KB
MD5

177c827306130a526c61b6bae68545d6
SHA1

e08f3c551f19f9726fcebc3c51400985cce74c7a
SHA256

6ac6c7054e275fd372d56b1466d9abed6da20a882993a69d60b547b05a4e7986
SHA512

c67d7b4b0cb0af86ebd59a71a5511da4c78ff8e69e547c139184eb69ccf7257a322f860cfc578ab9276785c415805b8ae1681a3a86dcd799650e81eab893137c
SSDEEP

768:CfA/tCL6cLFyYFCZFhbv1TNx5f5G8ql7D:b46chyYFCZFrTNfxG8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1260	1924	rundll32.exe	28
PID 1924 wrote to memory of 1260	1924	rundll32.exe	28
PID 1924 wrote to memory of 1260	1924	rundll32.exe	28
PID 1924 wrote to memory of 1260	1924	rundll32.exe	28
PID 1924 wrote to memory of 1260	1924	rundll32.exe	28
PID 1924 wrote to memory of 1260	1924	rundll32.exe	28
PID 1924 wrote to memory of 1260	1924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\177c827306130a526c61b6bae68545d6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\177c827306130a526c61b6bae68545d6_JaffaCakes118.dll,#1
  2⤵
  PID:1260

memory/1260-2-0x00000000000F0000-0x0000000000106000-memory.dmp

Filesize
88KB

Download
memory/1260-4-0x0000000000114000-0x0000000000115000-memory.dmp

Filesize
4KB

Download
memory/1260-3-0x0000000000100000-0x0000000000116000-memory.dmp

Filesize
88KB

Download
memory/1260-1-0x00000000000F0000-0x0000000000106000-memory.dmp

Filesize
88KB

Download
memory/1260-0-0x00000000000F0000-0x0000000000106000-memory.dmp

Filesize
88KB

Download