8b70ebd1458e49c6f52d76e028ac572e3ebccf0cfe6ac740432d554ab0c43074

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 23:44

Target

26ad156fd19170174514f26c22c0b203_JaffaCakes118.dll
Size

86KB
MD5

26ad156fd19170174514f26c22c0b203
SHA1

6d4206ae0f87dda2817d4c82e22635584e2548a2
SHA256

8b70ebd1458e49c6f52d76e028ac572e3ebccf0cfe6ac740432d554ab0c43074
SHA512

73745e8f309c8ac4c4205991b38df83905e6b90c1830b7fcc5a2b88c2e0644247f4318780938b2f3924599d437760d357c5ecd4c382772fd65e422a02392427f
SSDEEP

1536:GQCxl5IwWl16C7n4P1U0HVFGUH0JUXD8FCfczFwhYSzo2xW:mBEnuD0JUz84fcBtKoh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3052	3012	rundll32.exe	28
PID 3012 wrote to memory of 3052	3012	rundll32.exe	28
PID 3012 wrote to memory of 3052	3012	rundll32.exe	28
PID 3012 wrote to memory of 3052	3012	rundll32.exe	28
PID 3012 wrote to memory of 3052	3012	rundll32.exe	28
PID 3012 wrote to memory of 3052	3012	rundll32.exe	28
PID 3012 wrote to memory of 3052	3012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26ad156fd19170174514f26c22c0b203_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\26ad156fd19170174514f26c22c0b203_JaffaCakes118.dll,#1
  2⤵
  PID:3052

memory/3052-1-0x0000000010000000-0x000000001008D000-memory.dmp

Filesize
564KB

Download
memory/3052-0-0x0000000010000000-0x000000001008D000-memory.dmp

Filesize
564KB

Download