2f951d710a82ded0a071a60d081caf45fc7e7f9e56110c1174466e9eceabc9fe

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 16:21

Target

098e6c1203fe80216d52d7bd40d9393a_JaffaCakes118.dll
Size

66KB
MD5

098e6c1203fe80216d52d7bd40d9393a
SHA1

c97883a878e2f67374c1050f66b61d6252877dd7
SHA256

2f951d710a82ded0a071a60d081caf45fc7e7f9e56110c1174466e9eceabc9fe
SHA512

abd5f935f4cb206a80e62665e9faa7e8d9060dda53e88945ce89cf570b22b62ecef591a1aec01528952c4d76fa713ffaa85d86a46532309c87ff5b041d91e07e
SSDEEP

1536:g2NNyGkHjkDzELur8v0ZQjuNDlt6noTqptI+u6mzJb64BXljqv:guAGWIz8pcnltWtI+u6SJO4jqv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2076	2084	rundll32.exe	28
PID 2084 wrote to memory of 2076	2084	rundll32.exe	28
PID 2084 wrote to memory of 2076	2084	rundll32.exe	28
PID 2084 wrote to memory of 2076	2084	rundll32.exe	28
PID 2084 wrote to memory of 2076	2084	rundll32.exe	28
PID 2084 wrote to memory of 2076	2084	rundll32.exe	28
PID 2084 wrote to memory of 2076	2084	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\098e6c1203fe80216d52d7bd40d9393a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\098e6c1203fe80216d52d7bd40d9393a_JaffaCakes118.dll,#1
  2⤵
  PID:2076

memory/2076-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2076-4-0x000000001000B000-0x000000001000C000-memory.dmp

Filesize
4KB

Download
memory/2076-3-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2076-2-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2076-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download