9585be67f612f568d54df272194377dc59e100e75d21884e4f70d0d6f104c2b9

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 15:01

Target

09346f94a39589a20aefb5c1aa1ab386_JaffaCakes118.dll
Size

128KB
MD5

09346f94a39589a20aefb5c1aa1ab386
SHA1

98864b2ccedb55581fa9eee922375921072dafa2
SHA256

9585be67f612f568d54df272194377dc59e100e75d21884e4f70d0d6f104c2b9
SHA512

47ce616de74635dbcf39535884287c6a0c15e90cc3a9dc9e57d7f46e45f28e4c562965be034c91abf2257323fa90437d464725e5571a43496f31817204f46945
SSDEEP

3072:S+mD6rU50oY8ACFAXNcXN7mkidFzjMqqDLy/SoDbc:Aeks90N0FzQqqDLuS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1856	1932	rundll32.exe	28
PID 1932 wrote to memory of 1856	1932	rundll32.exe	28
PID 1932 wrote to memory of 1856	1932	rundll32.exe	28
PID 1932 wrote to memory of 1856	1932	rundll32.exe	28
PID 1932 wrote to memory of 1856	1932	rundll32.exe	28
PID 1932 wrote to memory of 1856	1932	rundll32.exe	28
PID 1932 wrote to memory of 1856	1932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09346f94a39589a20aefb5c1aa1ab386_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09346f94a39589a20aefb5c1aa1ab386_JaffaCakes118.dll,#1
  2⤵
  PID:1856

memory/1856-5-0x0000000010017000-0x0000000010026000-memory.dmp

Filesize
60KB

Download
memory/1856-4-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/1856-0-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/1856-6-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download