4cb5b15bc5ae1e574b745c28346eff7a5bcc35a269955bc97f283865b89312d1

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 17:02

Target

09bf901341b4999c29af2b3ef9416763_JaffaCakes118.dll
Size

47KB
MD5

09bf901341b4999c29af2b3ef9416763
SHA1

9c13797f936e75ae9ba3044f656c0e6fc666a271
SHA256

4cb5b15bc5ae1e574b745c28346eff7a5bcc35a269955bc97f283865b89312d1
SHA512

b2e5467b94f243afb9c9cfe85d9e270c49591d36dd85ae68bbbda30de715f15f35de78e0584855f5535d11269c74b8312a0052722075caee4e0f09ce17c0f303
SSDEEP

768:fvLBz7DYMlViXuaqGssAAZsdGZ33NEy1BQ8aHsDv55IoNFw9ah9x3eQ6bnv84GQ:3Lh7DDlVLCLZSu39EyrcsDv0oNFH2pGQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2792	1720	rundll32.exe	28
PID 1720 wrote to memory of 2792	1720	rundll32.exe	28
PID 1720 wrote to memory of 2792	1720	rundll32.exe	28
PID 1720 wrote to memory of 2792	1720	rundll32.exe	28
PID 1720 wrote to memory of 2792	1720	rundll32.exe	28
PID 1720 wrote to memory of 2792	1720	rundll32.exe	28
PID 1720 wrote to memory of 2792	1720	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09bf901341b4999c29af2b3ef9416763_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09bf901341b4999c29af2b3ef9416763_JaffaCakes118.dll,#1
  2⤵
  PID:2792

memory/2792-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2792-2-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2792-1-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download