120f257bfb61ede723e090b158fdde60d05f5bf04673baf1864deebd47c9919e

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 16:57

Target

07fb0f31118aa16db769c63133e9bf11_JaffaCakes118.dll
Size

15KB
MD5

07fb0f31118aa16db769c63133e9bf11
SHA1

fee65f1304e0a79bfb89c0d7562fb3c895d3bc66
SHA256

120f257bfb61ede723e090b158fdde60d05f5bf04673baf1864deebd47c9919e
SHA512

5905c0c8a37f5dd37b3d235e5489683a0eb41802339c6e662c79796c29e5ff4dee347cc631ddebb492d69a3f094d673dad668a325b11b7f75f22f082157371eb
SSDEEP

192:Tx0m61i7AJykoM7FWdBQVsqtygcmC+TP5HcN1lSkqww7q61VG4O20xzBTSkL8fl:qm61ikoiRWdojtHF80kqwZQGtltLW5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 3024	2432	rundll32.exe	28
PID 2432 wrote to memory of 3024	2432	rundll32.exe	28
PID 2432 wrote to memory of 3024	2432	rundll32.exe	28
PID 2432 wrote to memory of 3024	2432	rundll32.exe	28
PID 2432 wrote to memory of 3024	2432	rundll32.exe	28
PID 2432 wrote to memory of 3024	2432	rundll32.exe	28
PID 2432 wrote to memory of 3024	2432	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07fb0f31118aa16db769c63133e9bf11_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\07fb0f31118aa16db769c63133e9bf11_JaffaCakes118.dll,#1
  2⤵
  PID:3024

memory/3024-1-0x0000000010001000-0x0000000010002000-memory.dmp

Filesize
4KB

Download
memory/3024-0-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download