1ede40d41aa03e6a7f7c4256e70e73321a6bf6d7c8667360399cc3fb743afb99

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 09:59

Target

1593ed0853cce87249f59494f48639c0_JaffaCakes118.dll
Size

83KB
MD5

1593ed0853cce87249f59494f48639c0
SHA1

1f430875b1833ccd0ace4d5ead67ac78feeefe43
SHA256

1ede40d41aa03e6a7f7c4256e70e73321a6bf6d7c8667360399cc3fb743afb99
SHA512

d7a8d43a673e977f024980777cc67af341f430a944988e5c0753dd2c06dc3feda7a52fae32c938ac03669c9209678f9018f6e53097d0a3d22fd603a535f51e84
SSDEEP

1536:ezF6/duFnAXvt7M2OGiNyeIPcrqTWn5q112GLyYZkvUXg0xVF3:ey0AXj5iNyPpT4bG2akvUXg21

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1092	2240	rundll32.exe	28
PID 2240 wrote to memory of 1092	2240	rundll32.exe	28
PID 2240 wrote to memory of 1092	2240	rundll32.exe	28
PID 2240 wrote to memory of 1092	2240	rundll32.exe	28
PID 2240 wrote to memory of 1092	2240	rundll32.exe	28
PID 2240 wrote to memory of 1092	2240	rundll32.exe	28
PID 2240 wrote to memory of 1092	2240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1593ed0853cce87249f59494f48639c0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1593ed0853cce87249f59494f48639c0_JaffaCakes118.dll,#1
  2⤵
  PID:1092

memory/1092-1-0x0000000010032000-0x0000000010033000-memory.dmp

Filesize
4KB

Download
memory/1092-0-0x0000000010000000-0x0000000010038000-memory.dmp

Filesize
224KB

Download