709a2de5f1f6bb3e94657e8392da8303bbfbe8c24da305321fe566cc763f0d98

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 16:28

Target

230970813d04011ed55a70416d90c4ad_JaffaCakes118.dll
Size

24KB
MD5

230970813d04011ed55a70416d90c4ad
SHA1

955ca828e97dc102bbf6725d8b82067b73af850b
SHA256

709a2de5f1f6bb3e94657e8392da8303bbfbe8c24da305321fe566cc763f0d98
SHA512

d284ef4b8fd79ba1f38a82586d3e8572068bec1090aa1c3d0e5ea0c9585c8c6844ddbf8439b4cb883cad69eab1f490b958fa28d6b435c2d59fd95a868b1a7e8e
SSDEEP

384:wGiNEL2PIbUD7vBcCJyTjdi/Dm305qEH3tA7m4BsgBX1aRf:BlL2Q4D7vBcRGDhgQt6XBX1a9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1712	620	rundll32.exe	28
PID 620 wrote to memory of 1712	620	rundll32.exe	28
PID 620 wrote to memory of 1712	620	rundll32.exe	28
PID 620 wrote to memory of 1712	620	rundll32.exe	28
PID 620 wrote to memory of 1712	620	rundll32.exe	28
PID 620 wrote to memory of 1712	620	rundll32.exe	28
PID 620 wrote to memory of 1712	620	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\230970813d04011ed55a70416d90c4ad_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\230970813d04011ed55a70416d90c4ad_JaffaCakes118.dll,#1
  2⤵
  PID:1712

memory/1712-0-0x0000000000160000-0x000000000016D000-memory.dmp

Filesize
52KB

Download
memory/1712-2-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download
memory/1712-1-0x0000000000160000-0x000000000016D000-memory.dmp

Filesize
52KB

Download
memory/1712-3-0x0000000000170000-0x0000000000172000-memory.dmp

Filesize
8KB

Download