f5303df851c23a93d1f912158c14954bb6bff7823a60c130927a0c714fa5ebb8

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 18:09

Target

25bcba571a3ac61a63c0786c90b03e2e_JaffaCakes118.dll
Size

7KB
MD5

25bcba571a3ac61a63c0786c90b03e2e
SHA1

3987669a8630e11210d4b100181ded41b080903b
SHA256

f5303df851c23a93d1f912158c14954bb6bff7823a60c130927a0c714fa5ebb8
SHA512

f80ab4e4f7a1458d66736e670367ccc6c0fb0ab8a63cb634d74956ae004cb2943ba2c5efde4745f4fe9b6ba82d70c3defa2dfc81b819577e7b791c5042a403e3
SSDEEP

96:nPc44LoNUpyilulNTKvm3pY99C+hp4WRN2o8MTMP345QT3BL5aQts:n3FsslNTKv2pqBcWsMT84+tI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 3008	636	rundll32.exe	28
PID 636 wrote to memory of 3008	636	rundll32.exe	28
PID 636 wrote to memory of 3008	636	rundll32.exe	28
PID 636 wrote to memory of 3008	636	rundll32.exe	28
PID 636 wrote to memory of 3008	636	rundll32.exe	28
PID 636 wrote to memory of 3008	636	rundll32.exe	28
PID 636 wrote to memory of 3008	636	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25bcba571a3ac61a63c0786c90b03e2e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\25bcba571a3ac61a63c0786c90b03e2e_JaffaCakes118.dll,#1
  2⤵
  PID:3008

memory/3008-1-0x00000000000B0000-0x00000000000BA000-memory.dmp

Filesize
40KB

Download
memory/3008-3-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/3008-0-0x00000000000B0000-0x00000000000BA000-memory.dmp

Filesize
40KB

Download
memory/3008-2-0x00000000000B0000-0x00000000000BA000-memory.dmp

Filesize
40KB

Download
memory/3008-4-0x0000000000100000-0x0000000000102000-memory.dmp

Filesize
8KB

Download