0a327664b65e8309524efd45aa7f3e9b740dd64ff5513ac4a96e63d39ea4ba96

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 14:10

Target

1a6c17639838ce3eeef212150a9a6116_JaffaCakes118.dll
Size

81KB
MD5

1a6c17639838ce3eeef212150a9a6116
SHA1

780647bfaa3d9df9a1de5ed2d49065373a521356
SHA256

0a327664b65e8309524efd45aa7f3e9b740dd64ff5513ac4a96e63d39ea4ba96
SHA512

9c834ccb9273217b96d1b1f1fbee550609d11c61392fa414fdf4b09330c399cc9aa73dd89c2af2dc417928231037433772e537f901a532bc64c40bb2eca73166
SSDEEP

768:7P944a767tbkH2YUPKOYai3eZRI0g3DR5UO6Ed:TVa6bkW3PsH3eQzR5UO6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2928	2392	rundll32.exe	28
PID 2392 wrote to memory of 2928	2392	rundll32.exe	28
PID 2392 wrote to memory of 2928	2392	rundll32.exe	28
PID 2392 wrote to memory of 2928	2392	rundll32.exe	28
PID 2392 wrote to memory of 2928	2392	rundll32.exe	28
PID 2392 wrote to memory of 2928	2392	rundll32.exe	28
PID 2392 wrote to memory of 2928	2392	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a6c17639838ce3eeef212150a9a6116_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a6c17639838ce3eeef212150a9a6116_JaffaCakes118.dll,#1
  2⤵
  PID:2928

memory/2928-0-0x00000000750F0000-0x0000000075118000-memory.dmp

Filesize
160KB

Download
memory/2928-2-0x00000000750C0000-0x00000000750E8000-memory.dmp

Filesize
160KB

Download
memory/2928-1-0x00000000750F0000-0x0000000075118000-memory.dmp

Filesize
160KB

Download
memory/2928-3-0x00000000750C0000-0x00000000750E8000-memory.dmp

Filesize
160KB

Download