6ec0916bee7b29b9ce358b0b2c346c1fd6aaa6ce1c75e5b7ea63a87d80e1b8c9

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 17:08

Target

313fed313afddb9692a058abf8dca1d4_JaffaCakes118.dll
Size

10KB
MD5

313fed313afddb9692a058abf8dca1d4
SHA1

073cada2189bc6735304ddd06b34b7512f85a85e
SHA256

6ec0916bee7b29b9ce358b0b2c346c1fd6aaa6ce1c75e5b7ea63a87d80e1b8c9
SHA512

48cb2d7a95fdd2d26b87edc9091137101499746238fc6ea09db3fb4ca226c943845d2fa75186101f5f7aed32eba3553b7b48c9e539b978123eb7628faeed17c1
SSDEEP

192:SSgxdN7JQ3xy2JRko67FloqtuEThsbcMYuLA6YDZUIv0qYc/TAWWHSkiC:0fNJQ3xZ7gRl/t78rLApd/TAX3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2084	2560	rundll32.exe	30
PID 2560 wrote to memory of 2084	2560	rundll32.exe	30
PID 2560 wrote to memory of 2084	2560	rundll32.exe	30
PID 2560 wrote to memory of 2084	2560	rundll32.exe	30
PID 2560 wrote to memory of 2084	2560	rundll32.exe	30
PID 2560 wrote to memory of 2084	2560	rundll32.exe	30
PID 2560 wrote to memory of 2084	2560	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\313fed313afddb9692a058abf8dca1d4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\313fed313afddb9692a058abf8dca1d4_JaffaCakes118.dll,#1
  2⤵
  PID:2084

memory/2084-4-0x0000000010001000-0x0000000010002000-memory.dmp

Filesize
4KB

Download
memory/2084-3-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/2084-2-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/2084-1-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/2084-0-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download