c5898cc522e8d32b5c7337cae3dcd0e8cd9b4b46f819e81e262aff8fb22e3e43

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 01:04

Target

065a7f13e7f7680d31cc3e77de3411d4_JaffaCakes118.dll
Size

184KB
MD5

065a7f13e7f7680d31cc3e77de3411d4
SHA1

6bbc60ca0a58b50e180a23b7f1cd1f3315533d94
SHA256

c5898cc522e8d32b5c7337cae3dcd0e8cd9b4b46f819e81e262aff8fb22e3e43
SHA512

2f9588520bdb86f81b2e66c52af40814601267c65cba4cabe7fd36bac5ab4ee73981072a72f7518b273a955173030b324d07eefb36453190f08a1522699d12de
SSDEEP

3072:sLs314+48INcPLyPjHoOY/iZiNm+KD2S379qfu+Eok8ThCdoVVSsyaAoiVY7K9VI:qs3W+/INT7IDeijyHLEfVb8SVVzoYE61

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2028	2072	rundll32.exe	28
PID 2072 wrote to memory of 2028	2072	rundll32.exe	28
PID 2072 wrote to memory of 2028	2072	rundll32.exe	28
PID 2072 wrote to memory of 2028	2072	rundll32.exe	28
PID 2072 wrote to memory of 2028	2072	rundll32.exe	28
PID 2072 wrote to memory of 2028	2072	rundll32.exe	28
PID 2072 wrote to memory of 2028	2072	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\065a7f13e7f7680d31cc3e77de3411d4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\065a7f13e7f7680d31cc3e77de3411d4_JaffaCakes118.dll,#1
  2⤵
  PID:2028

memory/2028-2-0x0000000010000000-0x000000001003C000-memory.dmp

Filesize
240KB

Download
memory/2028-1-0x0000000010000000-0x000000001003C000-memory.dmp

Filesize
240KB

Download
memory/2028-0-0x0000000010000000-0x000000001003C000-memory.dmp

Filesize
240KB

Download