2ea88d080e4fe2a934d4e2d9c5acdd05d7daf2bdc1681a9977d4610cbb1c3bc4

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 19:55

Target

2716457bb3e3fbe3330ae64de0b1727a_JaffaCakes118.dll
Size

11KB
MD5

2716457bb3e3fbe3330ae64de0b1727a
SHA1

33576dfe2a046d2cdc583ba00c6f8c48ea7b8447
SHA256

2ea88d080e4fe2a934d4e2d9c5acdd05d7daf2bdc1681a9977d4610cbb1c3bc4
SHA512

6219a0c05f87f923c0fbf80118c0439be730baa92dda587aebaa5ac8304218d053dafd83b5a026c2b4be6c36362db0d8f4b2a1a72d25b550d42bfb02d66122fc
SSDEEP

192:45h9ZwfIwHkmIV386uPutH7x8BAGtJQUbQpYDcLqf40jznwk0Np7PjlTNIa2vPmk:45h4hrIVs6uPcstJQM4YbwE0Np7DIlq8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2600	1656	rundll32.exe	30
PID 1656 wrote to memory of 2600	1656	rundll32.exe	30
PID 1656 wrote to memory of 2600	1656	rundll32.exe	30
PID 1656 wrote to memory of 2600	1656	rundll32.exe	30
PID 1656 wrote to memory of 2600	1656	rundll32.exe	30
PID 1656 wrote to memory of 2600	1656	rundll32.exe	30
PID 1656 wrote to memory of 2600	1656	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2716457bb3e3fbe3330ae64de0b1727a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2716457bb3e3fbe3330ae64de0b1727a_JaffaCakes118.dll,#1
  2⤵
  PID:2600

memory/2600-0-0x0000000025000000-0x0000000025048000-memory.dmp

Filesize
288KB

Download
memory/2600-1-0x0000000025000000-0x0000000025048000-memory.dmp

Filesize
288KB

Download
memory/2600-2-0x0000000025040000-0x0000000025041000-memory.dmp

Filesize
4KB

Download