123fa1db8368fa65be1c6db323de4ae91c61234ec469edca3f125954950c4151

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 17:15

Target

081f92d8b7c7ea4d84f5bcba8de95bc9_JaffaCakes118.dll
Size

318KB
MD5

081f92d8b7c7ea4d84f5bcba8de95bc9
SHA1

029af4dbc2d1c00f482869a5fcec4b70652dec14
SHA256

123fa1db8368fa65be1c6db323de4ae91c61234ec469edca3f125954950c4151
SHA512

0b5a39c4e940814e0764d94867826360572b72c9596028bf6c98b164017247eb243d1dbb37a6be691474b2144194a040864fcd1beb0185800c621a1ab3a646d6
SSDEEP

6144:5jN1PSFPg7MWtzAgfi5bXbN13kLiyYGlayKTx3T9iJV/qPb/YV6Xfu16:5jHIPgv05bXbn3kLE1lKVQb1P

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1748	2248	rundll32.exe	28
PID 2248 wrote to memory of 1748	2248	rundll32.exe	28
PID 2248 wrote to memory of 1748	2248	rundll32.exe	28
PID 2248 wrote to memory of 1748	2248	rundll32.exe	28
PID 2248 wrote to memory of 1748	2248	rundll32.exe	28
PID 2248 wrote to memory of 1748	2248	rundll32.exe	28
PID 2248 wrote to memory of 1748	2248	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\081f92d8b7c7ea4d84f5bcba8de95bc9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\081f92d8b7c7ea4d84f5bcba8de95bc9_JaffaCakes118.dll,#1
  2⤵
  PID:1748

memory/1748-0-0x0000000005060000-0x00000000050B8000-memory.dmp

Filesize
352KB

Download
memory/1748-2-0x0000000005060000-0x00000000050B8000-memory.dmp

Filesize
352KB

Download
memory/1748-1-0x0000000005060000-0x00000000050B8000-memory.dmp

Filesize
352KB

Download