92273f36d9c2aef3a554fb7e546fcad18d0d6964c5ebae265b849c3b32bd733c

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 19:56

Target

0a8d5d2b65b68a098916276555e246f5_JaffaCakes118.dll
Size

142KB
MD5

0a8d5d2b65b68a098916276555e246f5
SHA1

534e4df6ef28a67ce578ccdda54db8466ef9f466
SHA256

92273f36d9c2aef3a554fb7e546fcad18d0d6964c5ebae265b849c3b32bd733c
SHA512

bfc8567d5e1492ed1601b63b0475ec14920a0d54d5fda3670f720967bc09823d030d8a194d0792cf29d968305e248fe8d80cbd1ad8c625bae05862531a9d5872
SSDEEP

3072:UlarDNpE1HnYeWo7MqqDLy/dfP9dcoCVQaB:yarDNCHYemqqDLuJjAe

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2272	2284	rundll32.exe	28
PID 2284 wrote to memory of 2272	2284	rundll32.exe	28
PID 2284 wrote to memory of 2272	2284	rundll32.exe	28
PID 2284 wrote to memory of 2272	2284	rundll32.exe	28
PID 2284 wrote to memory of 2272	2284	rundll32.exe	28
PID 2284 wrote to memory of 2272	2284	rundll32.exe	28
PID 2284 wrote to memory of 2272	2284	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a8d5d2b65b68a098916276555e246f5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a8d5d2b65b68a098916276555e246f5_JaffaCakes118.dll,#1
  2⤵
  PID:2272

memory/2272-5-0x000000001000E000-0x0000000010027000-memory.dmp

Filesize
100KB

Download
memory/2272-4-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download
memory/2272-0-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download
memory/2272-6-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download