25b3059a84ea39e27e31db57a039207c276d8b1d36ce424ef19138920414de45

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 07:40

Target

1950604b51f053ded4974031307b1281_JaffaCakes118.dll
Size

7KB
MD5

1950604b51f053ded4974031307b1281
SHA1

9faec0ff36749507f9e118c738265e17d30b2e03
SHA256

25b3059a84ea39e27e31db57a039207c276d8b1d36ce424ef19138920414de45
SHA512

7fb88d77a3714cdf1feffd4752a670e5a8ec2a47c0e588173424a8605e7f77e395da0d908e1270e89cd7d32f3791045ab434d4eca7efbfe61917887144620723
SSDEEP

96:nP+frv7MsmKk3BgSECjALEbsRyKZ4+lYj0ai8PTMP345QT3BL5aQt:nWfz/mKcBgSpMLEbBElYjLPT84+tI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1272	2444	rundll32.exe	28
PID 2444 wrote to memory of 1272	2444	rundll32.exe	28
PID 2444 wrote to memory of 1272	2444	rundll32.exe	28
PID 2444 wrote to memory of 1272	2444	rundll32.exe	28
PID 2444 wrote to memory of 1272	2444	rundll32.exe	28
PID 2444 wrote to memory of 1272	2444	rundll32.exe	28
PID 2444 wrote to memory of 1272	2444	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1950604b51f053ded4974031307b1281_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1950604b51f053ded4974031307b1281_JaffaCakes118.dll,#1
  2⤵
  PID:1272

memory/1272-3-0x0000000000120000-0x000000000012A000-memory.dmp

Filesize
40KB

Download
memory/1272-2-0x0000000000110000-0x000000000011A000-memory.dmp

Filesize
40KB

Download
memory/1272-1-0x0000000000110000-0x000000000011A000-memory.dmp

Filesize
40KB

Download
memory/1272-0-0x0000000000110000-0x000000000011A000-memory.dmp

Filesize
40KB

Download
memory/1272-4-0x0000000000120000-0x0000000000126000-memory.dmp

Filesize
24KB

Download