40492c5b0077b768409ad1747bdf69e560219d8e525e6b5c9dc7cfbafa4c64c2

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 00:53

Target

018a3509ee7dabea589ebe6a32460954_JaffaCakes118.dll
Size

86KB
MD5

018a3509ee7dabea589ebe6a32460954
SHA1

ecfa1902ad131f7db2018e27af8c42be7f3a58ce
SHA256

40492c5b0077b768409ad1747bdf69e560219d8e525e6b5c9dc7cfbafa4c64c2
SHA512

6da01563ff6f592597f0390eeea8ff44de3165033d4053a3cdf57febd62158fa1592a74fef9576595e5f0ecb081b34813b9a18416c0a6efd1a377263c6489b67
SSDEEP

1536:cNr74JmLDRPyZb2C92MEieWxs8WmJf/z2m9b+hCholIngkrWeVgrGnlUw:dqDNyZb2C92MEihx8mJf/zfHhoKgkrWg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3004	2988	rundll32.exe	28
PID 2988 wrote to memory of 3004	2988	rundll32.exe	28
PID 2988 wrote to memory of 3004	2988	rundll32.exe	28
PID 2988 wrote to memory of 3004	2988	rundll32.exe	28
PID 2988 wrote to memory of 3004	2988	rundll32.exe	28
PID 2988 wrote to memory of 3004	2988	rundll32.exe	28
PID 2988 wrote to memory of 3004	2988	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\018a3509ee7dabea589ebe6a32460954_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\018a3509ee7dabea589ebe6a32460954_JaffaCakes118.dll,#1
  2⤵
  PID:3004

memory/3004-0-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/3004-2-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/3004-1-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download