e362709c8905d22ae1c8603c5c2c1fb8492a8e096aa4f49b80077ed8ac31c197

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 15:05

Target

289844b24cf648a1752f0f0f5b28c223_JaffaCakes118.dll
Size

331KB
MD5

289844b24cf648a1752f0f0f5b28c223
SHA1

3bcff57e7b5f22c1e969c45e2aa751f746d7c5d9
SHA256

e362709c8905d22ae1c8603c5c2c1fb8492a8e096aa4f49b80077ed8ac31c197
SHA512

817b31d7ae82a87c6a4c64d578b4277b59b2d443fac88f7629846131be266a27ee8d6c5bffeb0e27b0ea702666141501d32b2a37d6e162ae4d1b8958f211976e
SSDEEP

6144:v5zrwbmXKpAAKIEhDAep/gEubrw4pmDh9jNfQJR/1l+7UuWNKH/jzIRkQ0dWihh2:prwbrf9EXpYrVpmt9jy1l+7xWsH/jzI3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1740	1672	rundll32.exe	30
PID 1672 wrote to memory of 1740	1672	rundll32.exe	30
PID 1672 wrote to memory of 1740	1672	rundll32.exe	30
PID 1672 wrote to memory of 1740	1672	rundll32.exe	30
PID 1672 wrote to memory of 1740	1672	rundll32.exe	30
PID 1672 wrote to memory of 1740	1672	rundll32.exe	30
PID 1672 wrote to memory of 1740	1672	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\289844b24cf648a1752f0f0f5b28c223_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\289844b24cf648a1752f0f0f5b28c223_JaffaCakes118.dll,#1
  2⤵
  PID:1740

memory/1740-0-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/1740-1-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download