432432b5dca806e5da7a3c87f593f5e7d60899342c021fd7ee395a174568c874

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 16:29

Target

28d47ae6f44c6800b6f17b0da3200a68_JaffaCakes118.dll
Size

68KB
MD5

28d47ae6f44c6800b6f17b0da3200a68
SHA1

31e90a95b95aca2dac89c5cb5888f60f6bbf90c7
SHA256

432432b5dca806e5da7a3c87f593f5e7d60899342c021fd7ee395a174568c874
SHA512

4dcb3a52aa658ba0b36571c5a689ba1ba5f9c7f76c0d90aa574d5d7a6eff0d5c11c758b84116f08b66650ac3b8178883b915364b1db2fa188de33bdc42d8b9c1
SSDEEP

1536:kIx6UzTnNe6l0xP2FyAlHBDoaor5jefGzsvJrAawmZqvDkV4:eul0xP2bBDe5jeezsvTZ0N

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28d47ae6f44c6800b6f17b0da3200a68_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28d47ae6f44c6800b6f17b0da3200a68_JaffaCakes118.dll,#1
  2⤵
  PID:1628

memory/1628-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1628-3-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1628-4-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1628-2-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1628-1-0x0000000010006000-0x000000001000B000-memory.dmp

Filesize
20KB

Download