97f09e7e18edb11dc39140be4f1712f15b244667ec95427cc75eb0432d8ec053

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 23:45

Target

0ff8642dcfeb1255fd54406f00493d30_JaffaCakes118.dll
Size

43KB
MD5

0ff8642dcfeb1255fd54406f00493d30
SHA1

c0012f65f11b7ed4b10784f4664a9d38034ddbd5
SHA256

97f09e7e18edb11dc39140be4f1712f15b244667ec95427cc75eb0432d8ec053
SHA512

7341dca923411c3042fdc3f62f788d613d5568b2e97952310731ec55fe508f931c1201e453885b3b263f9cf8aecb8a6a92d5f5e3fb1a67446689203974cc46a3
SSDEEP

768:9hn2Z0RhTBBSqoLMbnaua98b0xnsSVPfwAriYXZc+SyL+:9hnE0RhTBBSqowDO8bgTHpXZY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 1208	2052	rundll32.exe	28
PID 2052 wrote to memory of 1208	2052	rundll32.exe	28
PID 2052 wrote to memory of 1208	2052	rundll32.exe	28
PID 2052 wrote to memory of 1208	2052	rundll32.exe	28
PID 2052 wrote to memory of 1208	2052	rundll32.exe	28
PID 2052 wrote to memory of 1208	2052	rundll32.exe	28
PID 2052 wrote to memory of 1208	2052	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ff8642dcfeb1255fd54406f00493d30_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ff8642dcfeb1255fd54406f00493d30_JaffaCakes118.dll,#1
  2⤵
  PID:1208

memory/1208-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1208-1-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download