c38ad0e50eabfb57310f5a60b073cb11be18633d241969ddea671374f0ccc3c7

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 23:53

Target

01487b8b5b31a519b14ffd608ace3f14_JaffaCakes118.dll
Size

229KB
MD5

01487b8b5b31a519b14ffd608ace3f14
SHA1

12712dddb9218ae636b49ba373d595c83bc42b85
SHA256

c38ad0e50eabfb57310f5a60b073cb11be18633d241969ddea671374f0ccc3c7
SHA512

068101c4effb37aead38e3469117439cbb94bf26bbe3ccf0f9e7fb6b855bbdbdcdc1c20e349431509fb33ebc592d90d08267e4fa3d27609cbe98659c8f6b3f27
SSDEEP

3072:9aD3VlHndm+RBqLfa1tcLdGdCTftBI9VYOVeH/JyFcOAnWpdzhX4m:sDXndV+2t7dCx1OwfUGeF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1992	1712	rundll32.exe	28
PID 1712 wrote to memory of 1992	1712	rundll32.exe	28
PID 1712 wrote to memory of 1992	1712	rundll32.exe	28
PID 1712 wrote to memory of 1992	1712	rundll32.exe	28
PID 1712 wrote to memory of 1992	1712	rundll32.exe	28
PID 1712 wrote to memory of 1992	1712	rundll32.exe	28
PID 1712 wrote to memory of 1992	1712	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01487b8b5b31a519b14ffd608ace3f14_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01487b8b5b31a519b14ffd608ace3f14_JaffaCakes118.dll,#1
  2⤵
  PID:1992

memory/1992-3-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1992-2-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1992-1-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1992-0-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download