6c0e798aa4eaa973e0d8792517d4d64ca9d9f31bf847f5ce94aa24ef4f78e2da

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 00:43

Target

32a6476dfb7ff0b99e774e22a85ef4de_JaffaCakes118.dll
Size

1.1MB
MD5

32a6476dfb7ff0b99e774e22a85ef4de
SHA1

39c3360d3405b5faeee687300458dc09cd11eb16
SHA256

6c0e798aa4eaa973e0d8792517d4d64ca9d9f31bf847f5ce94aa24ef4f78e2da
SHA512

83d8067548b0250b6c2de0d674ed3a2b1a932d09667f7155a062b96701aa4294a459bfeb394f7ce1b19694ed2cd6d46d9fcb538bddd43d4b13768b65284787ee
SSDEEP

12288:zv3dgHuN5OsXHvgy/q2hY2qZuaVFK50ZDbl6a6FsvvvXUh:zv3dgOzLYcqwYDPK50H56qvvvXUh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2200	2124	rundll32.exe	30
PID 2124 wrote to memory of 2200	2124	rundll32.exe	30
PID 2124 wrote to memory of 2200	2124	rundll32.exe	30
PID 2124 wrote to memory of 2200	2124	rundll32.exe	30
PID 2124 wrote to memory of 2200	2124	rundll32.exe	30
PID 2124 wrote to memory of 2200	2124	rundll32.exe	30
PID 2124 wrote to memory of 2200	2124	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32a6476dfb7ff0b99e774e22a85ef4de_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32a6476dfb7ff0b99e774e22a85ef4de_JaffaCakes118.dll,#1
  2⤵
  PID:2200

memory/2200-0-0x000000005F820000-0x000000005F946000-memory.dmp

Filesize
1.1MB

Download
memory/2200-1-0x000000005F820000-0x000000005F946000-memory.dmp

Filesize
1.1MB

Download