44e7da7ebbb994452559816ef4744b5443f903d95c053908cfa32a59c4fe77c9

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 16:38

Target

0ec88620992359d1d335c4bbe7602693_JaffaCakes118.dll
Size

104KB
MD5

0ec88620992359d1d335c4bbe7602693
SHA1

2a5e572b9702139e8a03d597be3cfb6b7bd35096
SHA256

44e7da7ebbb994452559816ef4744b5443f903d95c053908cfa32a59c4fe77c9
SHA512

65a7882b0185849ed85bc77390f5e04f004b67a80754c8f12679b17bcd6113c3d1919e3f12a2d8ce6e1f9ed3cf1f02129eedc83f7ff6f7e0ed1b541355584da6
SSDEEP

1536:ETZ1EU0MUCL7Hy8cpbxHutlu7xB67ihpAlNWQh6gu2ZiigJx2UV8pW:ETZ1EU3LWpbJas7xB673N3h6qiigq0

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2848	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2848	2024	rundll32.exe	28
PID 2024 wrote to memory of 2848	2024	rundll32.exe	28
PID 2024 wrote to memory of 2848	2024	rundll32.exe	28
PID 2024 wrote to memory of 2848	2024	rundll32.exe	28
PID 2024 wrote to memory of 2848	2024	rundll32.exe	28
PID 2024 wrote to memory of 2848	2024	rundll32.exe	28
PID 2024 wrote to memory of 2848	2024	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ec88620992359d1d335c4bbe7602693_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ec88620992359d1d335c4bbe7602693_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2848

memory/2848-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2848-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download