5c0612d50f7eb4c92535ddcf9e69d37256938c8712bd83275df3ab33656dbea5

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 20:01

Target

0a92ac60db4c77107708e003dcb35617_JaffaCakes118.dll
Size

84KB
MD5

0a92ac60db4c77107708e003dcb35617
SHA1

659a672bd2bdaa106e0da64d3d6f3c627a97fe8d
SHA256

5c0612d50f7eb4c92535ddcf9e69d37256938c8712bd83275df3ab33656dbea5
SHA512

895c599d275cdf569bdfec5897eb889b5001583dbb80d6a193fe5bb3d9c5d798124878709e3abb40d18b5ce58c509645de60ce48105900020fa4c20d487186be
SSDEEP

1536:qLvl0UDzmGJttJ9shLOiYk4bomLQ3FL1CnCRJZuhMqqU+NV23S2G:qmGJtt8ROiYVboc8khMqqDLy/G

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2908	2868	rundll32.exe	28
PID 2868 wrote to memory of 2908	2868	rundll32.exe	28
PID 2868 wrote to memory of 2908	2868	rundll32.exe	28
PID 2868 wrote to memory of 2908	2868	rundll32.exe	28
PID 2868 wrote to memory of 2908	2868	rundll32.exe	28
PID 2868 wrote to memory of 2908	2868	rundll32.exe	28
PID 2868 wrote to memory of 2908	2868	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a92ac60db4c77107708e003dcb35617_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a92ac60db4c77107708e003dcb35617_JaffaCakes118.dll,#1
  2⤵
  PID:2908

memory/2908-4-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download
memory/2908-0-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download
memory/2908-5-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download