ab3ce568694aa23e5fce98087a3042ad8b60667291525590d333938f93c9075f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 07:24

Target

27b75f80c8a3f6943b3c36b74efc0c7f_JaffaCakes118.dll
Size

113KB
MD5

27b75f80c8a3f6943b3c36b74efc0c7f
SHA1

db7a5027e1e099493f9661df938baee79dde57b1
SHA256

ab3ce568694aa23e5fce98087a3042ad8b60667291525590d333938f93c9075f
SHA512

b4ad919a356a8f15060b659b05fa071c21744f94b7239f6d450c68d80d867a13895207bd374b47d8b4be1c768c852b2bbadd05065c315ee9f991ff7e0360a1c4
SSDEEP

1536:V80tppULBnUo4TGhe7PrZKIwHDt77KFfilnX0UeAgyeky:HtsLBnUoFSdKnHpKPFfky

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2460	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2460	2312	rundll32.exe	30
PID 2312 wrote to memory of 2460	2312	rundll32.exe	30
PID 2312 wrote to memory of 2460	2312	rundll32.exe	30
PID 2312 wrote to memory of 2460	2312	rundll32.exe	30
PID 2312 wrote to memory of 2460	2312	rundll32.exe	30
PID 2312 wrote to memory of 2460	2312	rundll32.exe	30
PID 2312 wrote to memory of 2460	2312	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27b75f80c8a3f6943b3c36b74efc0c7f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27b75f80c8a3f6943b3c36b74efc0c7f_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2460

memory/2460-0-0x0000000000190000-0x00000000001B4000-memory.dmp

Filesize
144KB

Download
memory/2460-1-0x00000000001A8000-0x00000000001AC000-memory.dmp

Filesize
16KB

Download
memory/2460-2-0x0000000000190000-0x00000000001B4000-memory.dmp

Filesize
144KB

Download
memory/2460-3-0x00000000006C0000-0x00000000006D5000-memory.dmp

Filesize
84KB

Download
memory/2460-5-0x0000000000190000-0x0000000000192000-memory.dmp

Filesize
8KB

Download