b773a012b92c2b0d0b5546de693fa660098979c500f11cb2862dd846c3847877

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 03:25

Target

0265a122bc60a3531e39dc7e68ffbb7a_JaffaCakes118.dll
Size

101KB
MD5

0265a122bc60a3531e39dc7e68ffbb7a
SHA1

297118b9c20071e906df465455d1b039ce31be64
SHA256

b773a012b92c2b0d0b5546de693fa660098979c500f11cb2862dd846c3847877
SHA512

c72b8e804402a1d54f758ba1a2797ca5b4b1074fbc72b619eae3836268e18dc555e4d67285e9f6dbba463025ebf3cd02435f3132e3fdbebf2382ef4be9d5f803
SSDEEP

1536:lkUU3CcEAGZtmx5OHhysevBk/FiAtDSU61o55n+0247qDwVPOwNsRfS64kx/w86:/UEBAKH9eQiAtuiG0J7q+vs5Z4kW3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0265a122bc60a3531e39dc7e68ffbb7a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0265a122bc60a3531e39dc7e68ffbb7a_JaffaCakes118.dll,#1
  2⤵
  PID:912

memory/912-0-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/912-3-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/912-2-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/912-1-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download