92b7b6d98b8ecb7f5195fc3d4737ee48cc34ffb31fcbb19f52116ae68ee6ac17

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 08:13

Target

33edccca90f927300d0b75b0cdab45ed_JaffaCakes118.dll
Size

103KB
MD5

33edccca90f927300d0b75b0cdab45ed
SHA1

bb4bfbe2d9331c279324074fbc4fa7c4ce735c59
SHA256

92b7b6d98b8ecb7f5195fc3d4737ee48cc34ffb31fcbb19f52116ae68ee6ac17
SHA512

847ee3d5d84370c9e8f131becc6f5e6f65dc6ceb096fdfb189e305a2d295549f7060dafe61e735d5e6b5705152c7c3a5520a4b30ebb76e5a24524f204131f2a0
SSDEEP

1536:rPjXQ3xawGfOcnJxn89Iz4BjucXrK4pZ5:7jmIwFWJx8K0BvpZ5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2212	1704	rundll32.exe	30
PID 1704 wrote to memory of 2212	1704	rundll32.exe	30
PID 1704 wrote to memory of 2212	1704	rundll32.exe	30
PID 1704 wrote to memory of 2212	1704	rundll32.exe	30
PID 1704 wrote to memory of 2212	1704	rundll32.exe	30
PID 1704 wrote to memory of 2212	1704	rundll32.exe	30
PID 1704 wrote to memory of 2212	1704	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33edccca90f927300d0b75b0cdab45ed_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33edccca90f927300d0b75b0cdab45ed_JaffaCakes118.dll,#1
  2⤵
  PID:2212

memory/2212-1-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/2212-0-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/2212-2-0x00000000006E0000-0x0000000000715000-memory.dmp

Filesize
212KB

Download