56f588b9bcf743f90b3da3c4037418c606e7facc7c75301e04699485cef47fb0

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 08:57

Target

2bbc0b6c0d79cc4b692268cbca2dda3d_JaffaCakes118.dll
Size

78KB
MD5

2bbc0b6c0d79cc4b692268cbca2dda3d
SHA1

b2e5e3b0ce29929e8c1d913d7fd4ab41c18a343e
SHA256

56f588b9bcf743f90b3da3c4037418c606e7facc7c75301e04699485cef47fb0
SHA512

332824ade8b48b15e29d31744c7ca6aa8b52424677b706d811b1502f4390bc4b783ff8f5ad2bcdb9f053d7cad96baf6025c43315caf8289235ddce65a5312a1b
SSDEEP

1536:YXgGHTpUj/T8de+1cAvsIkS1FEYd1PQvNkvVZXodJRVMxQXutcfwXpBrJKHgh2d/:eHTpUj4cAvsFGEY3uCtZXwv9foDUgTjY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 536	1900	rundll32.exe	31
PID 1900 wrote to memory of 536	1900	rundll32.exe	31
PID 1900 wrote to memory of 536	1900	rundll32.exe	31
PID 1900 wrote to memory of 536	1900	rundll32.exe	31
PID 1900 wrote to memory of 536	1900	rundll32.exe	31
PID 1900 wrote to memory of 536	1900	rundll32.exe	31
PID 1900 wrote to memory of 536	1900	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bbc0b6c0d79cc4b692268cbca2dda3d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bbc0b6c0d79cc4b692268cbca2dda3d_JaffaCakes118.dll,#1
  2⤵
  PID:536

memory/536-2-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/536-1-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/536-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download