64b005993828899f531df5efbcd528510a94805429e9f5a2422d96094c399a2e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 13:47

Target

0e4c85c18a64f77ba84f5a82225c43ab_JaffaCakes118.dll
Size

120KB
MD5

0e4c85c18a64f77ba84f5a82225c43ab
SHA1

44a84aef867fca2b705c1c013ab488701bcd763c
SHA256

64b005993828899f531df5efbcd528510a94805429e9f5a2422d96094c399a2e
SHA512

cbacca0c779747178a0e2a81ab12310be37efdf926430db688ef5a33f1b425ea55d276cfbacdd98bdd6b75a6048e419ab84e2381f26c3af9da0a7b7c120dc439
SSDEEP

3072:3KkSGZvlK3BpeIFciV3jU4nEvlTaPxpg0Vi8KGLYoLN:3KkSANIKIFc0N4kEc1nJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e4c85c18a64f77ba84f5a82225c43ab_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e4c85c18a64f77ba84f5a82225c43ab_JaffaCakes118.dll,#1
  2⤵
  PID:1792

memory/1792-3-0x000000006D3D0000-0x000000006D3F3000-memory.dmp

Filesize
140KB

Download
memory/1792-2-0x000000006D3D0000-0x000000006D3F3000-memory.dmp

Filesize
140KB

Download
memory/1792-1-0x000000006D3D0000-0x000000006D3F3000-memory.dmp

Filesize
140KB

Download
memory/1792-0-0x000000006D3D0000-0x000000006D3F3000-memory.dmp

Filesize
140KB

Download