89ec05b387244ae36a1909e5aacba1987b3bf1f0e4d35e1c385c002696f8408a

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 23:41

Target

4d97f0ab20923bfd539bf1120fa896be_JaffaCakes118.dll
Size

164KB
MD5

4d97f0ab20923bfd539bf1120fa896be
SHA1

3237c69b2027eaada082a521853f5ee540908472
SHA256

89ec05b387244ae36a1909e5aacba1987b3bf1f0e4d35e1c385c002696f8408a
SHA512

c4b2ceb407fb8080a30b20e037e1fbee9d7d79e0f40c32e4dca1a41a75cfecb9bdbc04729937816919c97db1617fd229c8402b0b91dc46d62d0534d9d3bf4ee8
SSDEEP

3072:v0XoUeZ/DVS8L73ea4MoCLfqQvFfEn1Vuad03:veoUeZR2TRCWQFfE3/0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1056	956	rundll32.exe	29
PID 956 wrote to memory of 1056	956	rundll32.exe	29
PID 956 wrote to memory of 1056	956	rundll32.exe	29
PID 956 wrote to memory of 1056	956	rundll32.exe	29
PID 956 wrote to memory of 1056	956	rundll32.exe	29
PID 956 wrote to memory of 1056	956	rundll32.exe	29
PID 956 wrote to memory of 1056	956	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d97f0ab20923bfd539bf1120fa896be_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d97f0ab20923bfd539bf1120fa896be_JaffaCakes118.dll,#1
  2⤵
  PID:1056

memory/1056-1-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/1056-0-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/1056-2-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1056-4-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1056-6-0x0000000002CB0000-0x0000000002D4F000-memory.dmp

Filesize
636KB

Download
memory/1056-10-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/1056-9-0x0000000003A90000-0x0000000003B99000-memory.dmp

Filesize
1.0MB

Download
memory/1056-7-0x0000000003700000-0x000000000382D000-memory.dmp

Filesize
1.2MB

Download
memory/1056-5-0x0000000002BE0000-0x0000000002CA9000-memory.dmp

Filesize
804KB

Download
memory/1056-11-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/1056-8-0x0000000000460000-0x000000000047F000-memory.dmp

Filesize
124KB

Download
memory/1056-3-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download