855032a6e937adb29485839e3374bc31c750ce51c8ec212004fcfd4f5ca90cf3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 14:30

Target

1ba7b85a91f9b22b4d052a666496bcbb_JaffaCakes118.dll
Size

94KB
MD5

1ba7b85a91f9b22b4d052a666496bcbb
SHA1

079a672b63fb5e74db35998b72fe50c94302c043
SHA256

855032a6e937adb29485839e3374bc31c750ce51c8ec212004fcfd4f5ca90cf3
SHA512

0d5ff8e62f5a27633b4f6146609f35721ab9912093ff5b3d9b4819ec3695d2884ee38aaabbee9228780d5196a5d383e75047ea53ffe5fc79565ae09e185a13fa
SSDEEP

1536:Xrj2DTisS3kalQqjFiZmPjdBWeu8kExIcG6QL7wX156gvMM3VpWJ8r:v2DTv1alQqjFRIeE6QLEl5ZMRJu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2224	2040	rundll32.exe	28
PID 2040 wrote to memory of 2224	2040	rundll32.exe	28
PID 2040 wrote to memory of 2224	2040	rundll32.exe	28
PID 2040 wrote to memory of 2224	2040	rundll32.exe	28
PID 2040 wrote to memory of 2224	2040	rundll32.exe	28
PID 2040 wrote to memory of 2224	2040	rundll32.exe	28
PID 2040 wrote to memory of 2224	2040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ba7b85a91f9b22b4d052a666496bcbb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ba7b85a91f9b22b4d052a666496bcbb_JaffaCakes118.dll,#1
  2⤵
  PID:2224

memory/2224-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2224-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download