1b32525c207df5eff4d6a18bfe5be040aa4d23a1718fad95bd81e6970fb51f36

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 22:54

Target

010049b9c741c7a95de9024b63266c26_JaffaCakes118.dll
Size

112KB
MD5

010049b9c741c7a95de9024b63266c26
SHA1

58747781edcee0fa489340b107e1293ded303bba
SHA256

1b32525c207df5eff4d6a18bfe5be040aa4d23a1718fad95bd81e6970fb51f36
SHA512

c0ab21979d279c87fe02f7fe5167bfb48cef510d44371ad2153f8cb9557ddcf5721b7683afed0e0690534b3b876fe5d8af24f96ca2608a87128df07b3fa9b710
SSDEEP

3072:EBpZ9WfgjG00K0LKrl6KnBHwdnMRwaDdSO:EDjG00NLKBBQVonN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1928	2320	rundll32.exe	28
PID 2320 wrote to memory of 1928	2320	rundll32.exe	28
PID 2320 wrote to memory of 1928	2320	rundll32.exe	28
PID 2320 wrote to memory of 1928	2320	rundll32.exe	28
PID 2320 wrote to memory of 1928	2320	rundll32.exe	28
PID 2320 wrote to memory of 1928	2320	rundll32.exe	28
PID 2320 wrote to memory of 1928	2320	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\010049b9c741c7a95de9024b63266c26_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\010049b9c741c7a95de9024b63266c26_JaffaCakes118.dll,#1
  2⤵
  PID:1928

memory/1928-0-0x000000001000E000-0x0000000010020000-memory.dmp

Filesize
72KB

Download
memory/1928-5-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download
memory/1928-1-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download
memory/1928-6-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download