82476e92bff28423e55ad7e36303b5b29744ba6a2cd1d65da949f4cf7d0f3738

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 23:17

Target

17e7cbebd54566ce956b53814fa00546_JaffaCakes118.dll
Size

7KB
MD5

17e7cbebd54566ce956b53814fa00546
SHA1

896310a95862f7b2783625ee829c79b15d613f8e
SHA256

82476e92bff28423e55ad7e36303b5b29744ba6a2cd1d65da949f4cf7d0f3738
SHA512

abf4a027782db0883bc4f361c616cbf6aa323f6686273e39181544a0ab40153dd683f3dea7a655771960ad68b0342983d4ac4513cc2070452398fb5e23105500
SSDEEP

192:p65Te1lG7UKaNmiQIC3jCmsWBv4xkgUwud:pETalG7UuiijNsWBv4+L

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1236	1240	rundll32.exe	28
PID 1240 wrote to memory of 1236	1240	rundll32.exe	28
PID 1240 wrote to memory of 1236	1240	rundll32.exe	28
PID 1240 wrote to memory of 1236	1240	rundll32.exe	28
PID 1240 wrote to memory of 1236	1240	rundll32.exe	28
PID 1240 wrote to memory of 1236	1240	rundll32.exe	28
PID 1240 wrote to memory of 1236	1240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17e7cbebd54566ce956b53814fa00546_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17e7cbebd54566ce956b53814fa00546_JaffaCakes118.dll,#1
  2⤵
  PID:1236

memory/1236-1-0x0000000015009000-0x000000001500A000-memory.dmp

Filesize
4KB

Download
memory/1236-0-0x0000000015000000-0x0000000015011000-memory.dmp

Filesize
68KB

Download