36dd1171e3dd59d464a8b1bc4b16b0931d0184f019bbf7c840b1917abe0fafee

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 11:23

Target

15d18596e7ef2b5e7a4dc2baa143dd7d_JaffaCakes118.dll
Size

15KB
MD5

15d18596e7ef2b5e7a4dc2baa143dd7d
SHA1

50ee8d7715058e564026489e87156a316171edf4
SHA256

36dd1171e3dd59d464a8b1bc4b16b0931d0184f019bbf7c840b1917abe0fafee
SHA512

325e899db5d0b953b4e7ccdfcf3fc17f947b83f6ea81b8250962af55ce0a998835d3f9168439520b9da3c88c56c63ffb8e9435febeb9422de79ef35651666587
SSDEEP

384:oeIMSuDmsJ99NM0XyEL0zmrb38/L/xdQgHA:xIMv9NPLL0zm38LACA

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1916	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 1916	2476	rundll32.exe	28
PID 2476 wrote to memory of 1916	2476	rundll32.exe	28
PID 2476 wrote to memory of 1916	2476	rundll32.exe	28
PID 2476 wrote to memory of 1916	2476	rundll32.exe	28
PID 2476 wrote to memory of 1916	2476	rundll32.exe	28
PID 2476 wrote to memory of 1916	2476	rundll32.exe	28
PID 2476 wrote to memory of 1916	2476	rundll32.exe	28
PID 1916 wrote to memory of 1120	1916	rundll32.exe	19
PID 1916 wrote to memory of 1172	1916	rundll32.exe	20
PID 1916 wrote to memory of 1232	1916	rundll32.exe	21
PID 1916 wrote to memory of 1864	1916	rundll32.exe	23
PID 1916 wrote to memory of 2476	1916	rundll32.exe	27

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1864

memory/1120-5-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1916-0-0x00000000001A0000-0x00000000001B0000-memory.dmp

Filesize
64KB

Download
memory/1916-1-0x00000000001A0000-0x00000000001B0000-memory.dmp

Filesize
64KB

Download
memory/1916-4-0x00000000001BB000-0x00000000001BC000-memory.dmp

Filesize
4KB

Download
memory/1916-3-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download
memory/1916-2-0x00000000001A0000-0x00000000001B0000-memory.dmp

Filesize
64KB

Download