7c97734988b98e9135c045a1e8c03d7e4ca7bb4fbc1cb8ab00a4a116eb05d8d1

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 22:25

Target

43953c2b85cf6937c5bc1d5e06635efe_JaffaCakes118.dll
Size

85KB
MD5

43953c2b85cf6937c5bc1d5e06635efe
SHA1

ee7780df25d8f5f0527d2e20d07f83058b545a3b
SHA256

7c97734988b98e9135c045a1e8c03d7e4ca7bb4fbc1cb8ab00a4a116eb05d8d1
SHA512

cedec80e63bf5152cf65060da08cb95306d6421a172e7ad103b64c717c60c74fcda4e189b40127be1ef215ad8e43fc94c71adf341a788aa1ec269ddd8948beb7
SSDEEP

1536:nw0yKsoJxGqtBehZQywvoUvCG5om1skUjbCS1FQlhzEomL:RHJXBAQyg5okbyV1uvrU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 808	1736	rundll32.exe	30
PID 1736 wrote to memory of 808	1736	rundll32.exe	30
PID 1736 wrote to memory of 808	1736	rundll32.exe	30
PID 1736 wrote to memory of 808	1736	rundll32.exe	30
PID 1736 wrote to memory of 808	1736	rundll32.exe	30
PID 1736 wrote to memory of 808	1736	rundll32.exe	30
PID 1736 wrote to memory of 808	1736	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43953c2b85cf6937c5bc1d5e06635efe_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\43953c2b85cf6937c5bc1d5e06635efe_JaffaCakes118.dll,#1
  2⤵
  PID:808

memory/808-3-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/808-2-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/808-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/808-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download