76b03e08226ab23c3be02b8754187398f6b5f4cf4e099dbc227a57eb34666f5a

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 07:36

Target

74c2f8412fc4899c7e1fddbbe0c608f0_JaffaCakes118.dll
Size

160KB
MD5

74c2f8412fc4899c7e1fddbbe0c608f0
SHA1

c9430de70615f3475fa75db01b19fc3be621922b
SHA256

76b03e08226ab23c3be02b8754187398f6b5f4cf4e099dbc227a57eb34666f5a
SHA512

b6ed34178d95f5184097a3d5b4cb5b566305a12bf8e57cb4fc7dbd93678ce2d0cd5c3ff61339529aa0fc7428f623316954f7d023300c1b7a5e21281f33e6fd45
SSDEEP

1536:Gls0QszjGz02ZPO9nEpXiMpi28p7Pbi4eTMluxtXDCntTnICS4Ay4bbaeR+fw7PQ:8RwOWpXiIgLbi4eTMlwDCnuo4JouPgC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1632	2204	rundll32.exe	28
PID 2204 wrote to memory of 1632	2204	rundll32.exe	28
PID 2204 wrote to memory of 1632	2204	rundll32.exe	28
PID 2204 wrote to memory of 1632	2204	rundll32.exe	28
PID 2204 wrote to memory of 1632	2204	rundll32.exe	28
PID 2204 wrote to memory of 1632	2204	rundll32.exe	28
PID 2204 wrote to memory of 1632	2204	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74c2f8412fc4899c7e1fddbbe0c608f0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\74c2f8412fc4899c7e1fddbbe0c608f0_JaffaCakes118.dll,#1
  2⤵
  PID:1632

memory/1632-0-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/1632-3-0x0000000003270000-0x000000000330F000-memory.dmp

Filesize
636KB

Download
memory/1632-2-0x00000000031A0000-0x0000000003269000-memory.dmp

Filesize
804KB

Download
memory/1632-5-0x0000000000210000-0x000000000022F000-memory.dmp

Filesize
124KB

Download
memory/1632-9-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/1632-10-0x0000000003620000-0x0000000003729000-memory.dmp

Filesize
1.0MB

Download
memory/1632-8-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1632-11-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/1632-7-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1632-6-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1632-4-0x0000000003310000-0x000000000343D000-memory.dmp

Filesize
1.2MB

Download
memory/1632-1-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/1632-13-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download