c6b1ce35b55a2b65da0f56f4ae3899ff5654e84efc093c9958b04fe1e06e4baa

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 17:04

Target

2d226895bf5a16212966fab83bf37f99_JaffaCakes118.dll
Size

134KB
MD5

2d226895bf5a16212966fab83bf37f99
SHA1

d606fc10cc2d9371c2d4a7d2884951f3a7385428
SHA256

c6b1ce35b55a2b65da0f56f4ae3899ff5654e84efc093c9958b04fe1e06e4baa
SHA512

0fb05573dddc043ef7226148643896e2586efdd4ef7caddb7d497106e26f1289c8def99251e38ee21015410fc38c45f8076ba8beeb74c3762f81850f7aa6e7a4
SSDEEP

3072:QRARXCGjqgROQ0KHedxaS/5d7VU40ruRjrlhLkvN/2ir2w:QRARXqFIHedxaQ5d7L4uR3YvN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2244	2248	rundll32.exe	28
PID 2248 wrote to memory of 2244	2248	rundll32.exe	28
PID 2248 wrote to memory of 2244	2248	rundll32.exe	28
PID 2248 wrote to memory of 2244	2248	rundll32.exe	28
PID 2248 wrote to memory of 2244	2248	rundll32.exe	28
PID 2248 wrote to memory of 2244	2248	rundll32.exe	28
PID 2248 wrote to memory of 2244	2248	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d226895bf5a16212966fab83bf37f99_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d226895bf5a16212966fab83bf37f99_JaffaCakes118.dll,#1
  2⤵
  PID:2244

memory/2244-0-0x0000000000650000-0x0000000000672000-memory.dmp

Filesize
136KB

Download
memory/2244-3-0x0000000000660000-0x0000000000682000-memory.dmp

Filesize
136KB

Download
memory/2244-2-0x0000000000650000-0x0000000000672000-memory.dmp

Filesize
136KB

Download
memory/2244-1-0x0000000000650000-0x0000000000672000-memory.dmp

Filesize
136KB

Download
memory/2244-4-0x0000000000660000-0x0000000000662000-memory.dmp

Filesize
8KB

Download