c65bcaf1a4d8135fb5f54cb77610ea6e3ff0e6a0f9ec676ddfa0e7ceb66432d8

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26/06/2024, 01:37

Target

10484c7dae5976221b8a418b73774903_JaffaCakes118.dll
Size

40KB
MD5

10484c7dae5976221b8a418b73774903
SHA1

11ac4559c275434dc149dfdcb44c5251dbb313ab
SHA256

c65bcaf1a4d8135fb5f54cb77610ea6e3ff0e6a0f9ec676ddfa0e7ceb66432d8
SHA512

d9ad7d9a117b7d8ebeb09fcf026379c62cc28e5f68187b5885e782728bb7d2da89308a27913c80504fae5a592cfb47980e54b8b78881fff91bd4e103ec845bb6
SSDEEP

768:eU1Zn5j3nedPHyNKi6VgBJdBIBgdnjNrS917Ok4Gyukxniwa2:eU1Z1nedKNKi6Vg7P3dnZW91dHkxn02

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2432	2924	rundll32.exe	28
PID 2924 wrote to memory of 2432	2924	rundll32.exe	28
PID 2924 wrote to memory of 2432	2924	rundll32.exe	28
PID 2924 wrote to memory of 2432	2924	rundll32.exe	28
PID 2924 wrote to memory of 2432	2924	rundll32.exe	28
PID 2924 wrote to memory of 2432	2924	rundll32.exe	28
PID 2924 wrote to memory of 2432	2924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\10484c7dae5976221b8a418b73774903_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\10484c7dae5976221b8a418b73774903_JaffaCakes118.dll,#1
  2⤵
  PID:2432

memory/2432-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2432-1-0x00000000001D0000-0x00000000001DE000-memory.dmp

Filesize
56KB

Download
memory/2432-2-0x00000000001D0000-0x00000000001DE000-memory.dmp

Filesize
56KB

Download