7e5ea14c33fb7fc5803bd8d46d3f3548534dd4ea691e498e58030c51614eee3d

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 11:36

Target

15db98ea3890eb11962eb20c8d194df9_JaffaCakes118.dll
Size

48KB
MD5

15db98ea3890eb11962eb20c8d194df9
SHA1

f81d0b53bc045bbdd97239da7795c3e9fc511e51
SHA256

7e5ea14c33fb7fc5803bd8d46d3f3548534dd4ea691e498e58030c51614eee3d
SHA512

52f025a0375f232ecb12e341d8f9a9ca24970d8f3c98bb9c58821ffe7fdd4b7d48fb2aadb044c3b2cac58e58183b8f9d843d9002ad67bb6b12893370b721008e
SSDEEP

384:hXwpV4MzaesJr5SHASrw1hVfmLhPVCE2jrWSj+vxFU5qMJ6E1c6/vPXk9:hXwjrV48JrcL+LhPVCnuDLUNlPXk9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1144	1760	rundll32.exe	28
PID 1760 wrote to memory of 1144	1760	rundll32.exe	28
PID 1760 wrote to memory of 1144	1760	rundll32.exe	28
PID 1760 wrote to memory of 1144	1760	rundll32.exe	28
PID 1760 wrote to memory of 1144	1760	rundll32.exe	28
PID 1760 wrote to memory of 1144	1760	rundll32.exe	28
PID 1760 wrote to memory of 1144	1760	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15db98ea3890eb11962eb20c8d194df9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\15db98ea3890eb11962eb20c8d194df9_JaffaCakes118.dll,#1
  2⤵
  PID:1144

memory/1144-2-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/1144-3-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/1144-1-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/1144-0-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download