85a817cc76b093a559a417266faa534c2a28c64bdcff37bae911afd6803620fa

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 22:23

Target

0af160a1c76c91041a1250c01742db99_JaffaCakes118.dll
Size

249KB
MD5

0af160a1c76c91041a1250c01742db99
SHA1

936366872b4284f47c382488a78762f46146a13d
SHA256

85a817cc76b093a559a417266faa534c2a28c64bdcff37bae911afd6803620fa
SHA512

97e8a570cc4503f66c51d5a339adb57ae92fa32cd53be38fefcf295fd6e78ed5eccbd75e1dd5f7c10ee25efdc39fddda44e7233ebc0dd6e808f51f9cd2b8c77c
SSDEEP

6144:x3EXRtK1AF0rK6iTHK8fAn1/ziSq63XXXqwb3e877vhZdE:s7F8KjTHjA17iRkXHqwJ793E

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1428	1644	rundll32.exe	28
PID 1644 wrote to memory of 1428	1644	rundll32.exe	28
PID 1644 wrote to memory of 1428	1644	rundll32.exe	28
PID 1644 wrote to memory of 1428	1644	rundll32.exe	28
PID 1644 wrote to memory of 1428	1644	rundll32.exe	28
PID 1644 wrote to memory of 1428	1644	rundll32.exe	28
PID 1644 wrote to memory of 1428	1644	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0af160a1c76c91041a1250c01742db99_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0af160a1c76c91041a1250c01742db99_JaffaCakes118.dll,#1
  2⤵
  PID:1428

memory/1428-0-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/1428-1-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/1428-2-0x00000000001B0000-0x00000000001EC000-memory.dmp

Filesize
240KB

Download