b0100650c4f20488cc6e0b57c3e1f9ba7bbd138c060d28b83207322270e12256

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 14:14

Target

2ca93b1d1c9eece0f275393af188d046_JaffaCakes118.dll
Size

122KB
MD5

2ca93b1d1c9eece0f275393af188d046
SHA1

7947f9c6e1aaf6ba06c51356b4e0eb5ee119710b
SHA256

b0100650c4f20488cc6e0b57c3e1f9ba7bbd138c060d28b83207322270e12256
SHA512

72c5d61c43be213259c9de72c5e03c146ec15028b290d55d081e502c29ddf38fc7866424e92c9131b3f2897654af02d5782b204523bcad0e8aa620a0518284b2
SSDEEP

3072:zl+/A+5umUdBvuI5kGlZ6wayjtMpkEAQ8WCvKpdXbb:XGumuBmIuwa3uOzrb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2364	2556	rundll32.exe	30
PID 2556 wrote to memory of 2364	2556	rundll32.exe	30
PID 2556 wrote to memory of 2364	2556	rundll32.exe	30
PID 2556 wrote to memory of 2364	2556	rundll32.exe	30
PID 2556 wrote to memory of 2364	2556	rundll32.exe	30
PID 2556 wrote to memory of 2364	2556	rundll32.exe	30
PID 2556 wrote to memory of 2364	2556	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ca93b1d1c9eece0f275393af188d046_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ca93b1d1c9eece0f275393af188d046_JaffaCakes118.dll,#1
  2⤵
  PID:2364

memory/2364-0-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download
memory/2364-1-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download
memory/2364-2-0x0000000010054000-0x0000000010055000-memory.dmp

Filesize
4KB

Download