f45bf66960404cafb828eae1ad8575b5005f5822a45eb22e85defcc51d51605b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 08:14

Target

15490e6313aa151c7e0a90cb8e6c5d22_JaffaCakes118.dll
Size

34KB
MD5

15490e6313aa151c7e0a90cb8e6c5d22
SHA1

e60a3f3e6176944dbe3520280714de033f88e8a7
SHA256

f45bf66960404cafb828eae1ad8575b5005f5822a45eb22e85defcc51d51605b
SHA512

d3ed306cf5a2d48dff18228178b141f6db93c438fc612384a9b4a7d6a47cff5dab16825d40a73c45d5a43ac034bf62e9165273e20fdd12c4680027f01d3e5458
SSDEEP

768:MTNLuiHkdJgT4XREpE0g7t0LT2MWyvjROzqfaBPi:4LuiHkzPKpc9zyFEq+K

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2244	2240	rundll32.exe	28
PID 2240 wrote to memory of 2244	2240	rundll32.exe	28
PID 2240 wrote to memory of 2244	2240	rundll32.exe	28
PID 2240 wrote to memory of 2244	2240	rundll32.exe	28
PID 2240 wrote to memory of 2244	2240	rundll32.exe	28
PID 2240 wrote to memory of 2244	2240	rundll32.exe	28
PID 2240 wrote to memory of 2244	2240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15490e6313aa151c7e0a90cb8e6c5d22_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\15490e6313aa151c7e0a90cb8e6c5d22_JaffaCakes118.dll,#1
  2⤵
  PID:2244

memory/2244-0-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/2244-1-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download