a19ded5e22fe788d7129600c4476694e6928149f67832f403e7344d81a9636d5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 18:10

Target

2d5462f6a25592fe1b47d1271b4e2cc5_JaffaCakes118.dll
Size

24KB
MD5

2d5462f6a25592fe1b47d1271b4e2cc5
SHA1

eab8ae126620edbf7f273b5deb982376df6fc53f
SHA256

a19ded5e22fe788d7129600c4476694e6928149f67832f403e7344d81a9636d5
SHA512

4e4f96559aa5267310a2dbed9c3b55545ede68ee4763feb78f732a5dcbf7e7e70e7db1e1f2a982a9ec8f73b4708fa8f4e4f52f411ce61954750b24d15bddbceb
SSDEEP

96:BnWpeOVUcRrL3Cwskfm1DCI0Uav9hue3axU49Ew6R:BnDOhRrLXoWU29ke/we

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2276	2252	rundll32.exe	30
PID 2252 wrote to memory of 2276	2252	rundll32.exe	30
PID 2252 wrote to memory of 2276	2252	rundll32.exe	30
PID 2252 wrote to memory of 2276	2252	rundll32.exe	30
PID 2252 wrote to memory of 2276	2252	rundll32.exe	30
PID 2252 wrote to memory of 2276	2252	rundll32.exe	30
PID 2252 wrote to memory of 2276	2252	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d5462f6a25592fe1b47d1271b4e2cc5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d5462f6a25592fe1b47d1271b4e2cc5_JaffaCakes118.dll,#1
  2⤵
  PID:2276

memory/2276-0-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/2276-1-0x0000000077ACF000-0x0000000077AD0000-memory.dmp

Filesize
4KB

Download
memory/2276-2-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/2276-3-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download