71079a2d8b34ea9dfd4f214cb1fa47e222b0aeb3749eb51bf4e9a2aa0ee0ae52

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 05:12

Target

2b188b77c8e9ba55edc4bf7b66c3b245_JaffaCakes118.dll
Size

48KB
MD5

2b188b77c8e9ba55edc4bf7b66c3b245
SHA1

7b83aed4390a36ef29e5011ae6f2e76706b7460d
SHA256

71079a2d8b34ea9dfd4f214cb1fa47e222b0aeb3749eb51bf4e9a2aa0ee0ae52
SHA512

e30ac1409bbbfa4736bb11470e93af13fbf5a4870440929249294803982a7c05569ccb0e9e171a57debce9378509464486e5ff5e3e3424f3af21ce170aa57d2f
SSDEEP

768:KrY2Z1EDhOFQjkVNOSPPLLKnpJjn1LyC8p0+mtGAMoci/mU5QyLP20Pa2KJJRT1:w/4DYyjkxP/Cj1mCJEroSwT7gT1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 1544	788	rundll32.exe	28
PID 788 wrote to memory of 1544	788	rundll32.exe	28
PID 788 wrote to memory of 1544	788	rundll32.exe	28
PID 788 wrote to memory of 1544	788	rundll32.exe	28
PID 788 wrote to memory of 1544	788	rundll32.exe	28
PID 788 wrote to memory of 1544	788	rundll32.exe	28
PID 788 wrote to memory of 1544	788	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b188b77c8e9ba55edc4bf7b66c3b245_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b188b77c8e9ba55edc4bf7b66c3b245_JaffaCakes118.dll,#1
  2⤵
  PID:1544

memory/1544-0-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/1544-4-0x000000001001B000-0x000000001001C000-memory.dmp

Filesize
4KB

Download
memory/1544-3-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/1544-2-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/1544-1-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download