d69f61f779b581dbc8a078769f1d6ba9b365dbb3421c4a913e77011d228517f3

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 02:42

Target

245c80a82073593cf8f0621f742d1b32_JaffaCakes118.dll
Size

128KB
MD5

245c80a82073593cf8f0621f742d1b32
SHA1

9212cb90bd895fefbcfa1e5979b3ce535d748e72
SHA256

d69f61f779b581dbc8a078769f1d6ba9b365dbb3421c4a913e77011d228517f3
SHA512

baba2322ab9efc2ac583ba923fe12282e178cad5fdaa1c8e6bbee9a8807bad5bc5a974038240f9af8e2f85a23ad61701633c5dacb6c4c1c7fd9928072876b1e2
SSDEEP

3072:qUxM82xKJUjdiatsOBhIm2VOrsIlzvVSbu/yf3S:vxNKbxtBhFhs7um3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\245c80a82073593cf8f0621f742d1b32_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\245c80a82073593cf8f0621f742d1b32_JaffaCakes118.dll,#1
  2⤵
  PID:1512

memory/1512-0-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/1512-6-0x0000000010012000-0x0000000010024000-memory.dmp

Filesize
72KB

Download
memory/1512-5-0x0000000000240000-0x000000000024A000-memory.dmp

Filesize
40KB

Download
memory/1512-1-0x0000000000240000-0x000000000024A000-memory.dmp

Filesize
40KB

Download
memory/1512-7-0x0000000000240000-0x000000000024A000-memory.dmp

Filesize
40KB

Download