5fcba9d256b2298c32d939c30fbc29f92ee27532f0490a3141bda93aaa7c74fc

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 23:46

Target

013f5f6f344771c8b01073e012fbdde1_JaffaCakes118.dll
Size

247KB
MD5

013f5f6f344771c8b01073e012fbdde1
SHA1

7c52333e1f1ba66c72814f7457157d86224518be
SHA256

5fcba9d256b2298c32d939c30fbc29f92ee27532f0490a3141bda93aaa7c74fc
SHA512

20e830c2675ddeb0e44aaa91ba6daefe6a6d84c241a33906ee8f68db97b16633b5710d17509e27fbd2c1eb1660c3fe5eadb42d12229c5aa977dc87ad2e9e53a1
SSDEEP

6144:BkNG+NdkuFGXBYV3APFkvCN6J+zUwvWgxUa:BkDNd3GXBi3UFkvfJ+4+Tt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2416	2360	rundll32.exe	28
PID 2360 wrote to memory of 2416	2360	rundll32.exe	28
PID 2360 wrote to memory of 2416	2360	rundll32.exe	28
PID 2360 wrote to memory of 2416	2360	rundll32.exe	28
PID 2360 wrote to memory of 2416	2360	rundll32.exe	28
PID 2360 wrote to memory of 2416	2360	rundll32.exe	28
PID 2360 wrote to memory of 2416	2360	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\013f5f6f344771c8b01073e012fbdde1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\013f5f6f344771c8b01073e012fbdde1_JaffaCakes118.dll,#1
  2⤵
  PID:2416

memory/2416-0-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/2416-2-0x00000000001D0000-0x000000000020C000-memory.dmp

Filesize
240KB

Download
memory/2416-1-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download