b7ae04e4a8fe1c9bea3a994ce0de32c74a1b5364906bd228f993733565ca1492

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 11:31

Target

05999dbc07c56fdee24c035f1f378c70_JaffaCakes118.dll
Size

81KB
MD5

05999dbc07c56fdee24c035f1f378c70
SHA1

96687cffa93bb5981c86ec31f3f4523ac12b2d37
SHA256

b7ae04e4a8fe1c9bea3a994ce0de32c74a1b5364906bd228f993733565ca1492
SHA512

c91a5ba1b954b2449c974f86e33a250f0c8fbc702a0e736add84187debaf45c2b2ae2cfb5e33899aac552980923c85b3e6d00d424b38ecbee64779518a7ae89e
SSDEEP

1536:+AOuoy1b2zfNHxX7vs+aw0hiwtQH4KsYFlFnrBfGhN6viGx2kRXfDjneG8:5n2zlHxLvss0hltQH+olFrxG76v8qPDa

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2104	2964	rundll32.exe	28
PID 2964 wrote to memory of 2104	2964	rundll32.exe	28
PID 2964 wrote to memory of 2104	2964	rundll32.exe	28
PID 2964 wrote to memory of 2104	2964	rundll32.exe	28
PID 2964 wrote to memory of 2104	2964	rundll32.exe	28
PID 2964 wrote to memory of 2104	2964	rundll32.exe	28
PID 2964 wrote to memory of 2104	2964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05999dbc07c56fdee24c035f1f378c70_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05999dbc07c56fdee24c035f1f378c70_JaffaCakes118.dll,#1
  2⤵
  PID:2104

memory/2104-2-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/2104-1-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/2104-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download