7a15085cbae8dcd17b39b10b29226176d010b36961f3d899bb0bf3dd949138c6

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 22:15

Target

0fb8bb8eae57b72f89f20fbfa8649c1e_JaffaCakes118.dll
Size

25KB
MD5

0fb8bb8eae57b72f89f20fbfa8649c1e
SHA1

40b691b4ff7195bd3757cb1540d3cf3e8f48a5b5
SHA256

7a15085cbae8dcd17b39b10b29226176d010b36961f3d899bb0bf3dd949138c6
SHA512

2d067b5c1e0e0c6a11b03d68ffbe68da344588c8967bc6cf2b319a53282e76779b7a20c12fa9b01e26d8feee808baa8670b813d0fedb4217be2e9866f1a7b734
SSDEEP

384:OPeUjCShTLBTXC7YDBVDN26H7aQmVuFmNRN8RBGQm322qkepnpEuJb36YtcV3Cv:Z1ypbC7YDjDX1LTBGP32XkMKuJbjgS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1120	2232	rundll32.exe	28
PID 2232 wrote to memory of 1120	2232	rundll32.exe	28
PID 2232 wrote to memory of 1120	2232	rundll32.exe	28
PID 2232 wrote to memory of 1120	2232	rundll32.exe	28
PID 2232 wrote to memory of 1120	2232	rundll32.exe	28
PID 2232 wrote to memory of 1120	2232	rundll32.exe	28
PID 2232 wrote to memory of 1120	2232	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fb8bb8eae57b72f89f20fbfa8649c1e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fb8bb8eae57b72f89f20fbfa8649c1e_JaffaCakes118.dll,#1
  2⤵
  PID:1120

memory/1120-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1120-3-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1120-2-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1120-1-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download