20f7a5cbe6ce7db3cb75e482b48769b61dd279143e13fd4f10c5153cf8e1efde

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 13:58

Target

350363be91767526814317bc018075f7_JaffaCakes118.dll
Size

57KB
MD5

350363be91767526814317bc018075f7
SHA1

1ab343db144e66abc88a9228bbe093b77035f92e
SHA256

20f7a5cbe6ce7db3cb75e482b48769b61dd279143e13fd4f10c5153cf8e1efde
SHA512

efd2d7f88a8fa9e869ef97979598f66cca591b6c362b783c23cf7044ad9d81873c425a7750c632671b98e9e374a2fb3032b1e4d4a70db7fb3b3c6d4cc8a3cc8b
SSDEEP

1536:VZIcCxRlgAUdZo/kfmm/N7o/SzRI4kL2zG:r+Oo/kfmsN7oSrzG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2128	2604	rundll32.exe	30
PID 2604 wrote to memory of 2128	2604	rundll32.exe	30
PID 2604 wrote to memory of 2128	2604	rundll32.exe	30
PID 2604 wrote to memory of 2128	2604	rundll32.exe	30
PID 2604 wrote to memory of 2128	2604	rundll32.exe	30
PID 2604 wrote to memory of 2128	2604	rundll32.exe	30
PID 2604 wrote to memory of 2128	2604	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\350363be91767526814317bc018075f7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\350363be91767526814317bc018075f7_JaffaCakes118.dll,#1
  2⤵
  PID:2128

memory/2128-3-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2128-2-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2128-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2128-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download