3855c98f74d968743e9435c207d2c7ff1eb507ba1d259eb16bf1e2eb7d650db4

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 14:36

Target

06e393af02eda67fa678d6bb623ba311_JaffaCakes118.dll
Size

79KB
MD5

06e393af02eda67fa678d6bb623ba311
SHA1

311168d00d0c28f6087b8e93d3d483f71e6c53dc
SHA256

3855c98f74d968743e9435c207d2c7ff1eb507ba1d259eb16bf1e2eb7d650db4
SHA512

64b5b1b8ec0157b19db6e1bd6e6187e42bde3115ee628ec5fdb3eb61cebe4b13531f73e79ae7c5b287e11cbe06bc743be579a30ba9653dd3065b5304ae73b834
SSDEEP

1536:GFTxzL0IgN7ixcwPsu6IgMeRTjimEjBPv3B+j9v6kfZJ:o9v0IgN7dwP53etZEZ3qR3P

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 3048	1728	rundll32.exe	28
PID 1728 wrote to memory of 3048	1728	rundll32.exe	28
PID 1728 wrote to memory of 3048	1728	rundll32.exe	28
PID 1728 wrote to memory of 3048	1728	rundll32.exe	28
PID 1728 wrote to memory of 3048	1728	rundll32.exe	28
PID 1728 wrote to memory of 3048	1728	rundll32.exe	28
PID 1728 wrote to memory of 3048	1728	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06e393af02eda67fa678d6bb623ba311_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06e393af02eda67fa678d6bb623ba311_JaffaCakes118.dll,#1
  2⤵
  PID:3048

memory/3048-4-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/3048-3-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/3048-2-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/3048-1-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/3048-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download