28f4304182db177d70ef77f49611b9f52c06776ed45854b8334ab32dcda3bd64

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 12:14

Target

0e074f9b0d3bae15495f8af864844df1_JaffaCakes118.dll
Size

33KB
MD5

0e074f9b0d3bae15495f8af864844df1
SHA1

a2be44652ace1363d0f6b691f80d0b5fe8ddc2f2
SHA256

28f4304182db177d70ef77f49611b9f52c06776ed45854b8334ab32dcda3bd64
SHA512

23e701e92c083a3d32544f90ba26b94e39761ed4b40b886300990228cc242a22fc3d15fe25f9ad01d36c1f0cb38648ac868895624e397fddbd084cdcce5a9816
SSDEEP

768:0zzfy7gPcUqSZ4Q6LTOe8ZZ7mVFqLJhANuRnxS3Cnon:0P2gPXevSJrLz3S/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1768	3020	rundll32.exe	28
PID 3020 wrote to memory of 1768	3020	rundll32.exe	28
PID 3020 wrote to memory of 1768	3020	rundll32.exe	28
PID 3020 wrote to memory of 1768	3020	rundll32.exe	28
PID 3020 wrote to memory of 1768	3020	rundll32.exe	28
PID 3020 wrote to memory of 1768	3020	rundll32.exe	28
PID 3020 wrote to memory of 1768	3020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e074f9b0d3bae15495f8af864844df1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e074f9b0d3bae15495f8af864844df1_JaffaCakes118.dll,#1
  2⤵
  PID:1768

memory/1768-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/1768-4-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/1768-3-0x00000000000F0000-0x00000000000F6000-memory.dmp

Filesize
24KB

Download
memory/1768-2-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/1768-1-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download