e606dfd60e58abc6eed5c45d278c39c8f38b54424a907066c268024553a023cb

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 04:10

Target

402509a678fd4b0e6941a8e3489caaba_JaffaCakes118.dll
Size

85KB
MD5

402509a678fd4b0e6941a8e3489caaba
SHA1

d3a60683688e7efaf791e5ec609db5f5ec9711f0
SHA256

e606dfd60e58abc6eed5c45d278c39c8f38b54424a907066c268024553a023cb
SHA512

48fc7aea1f940d787c0ba14b1a6e9db47daa754106ff11779e00463aaab2448e6cde883f0c676a365424b85788ba26f848c5d4d346572a4c53854fc999eb00dd
SSDEEP

1536:Ay8tebVfP045HNpV27vgFAMwbODmWIw48TgSvaThuoGmy:AyqG84tNLkvgFqbFMLsSCuoG7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2972	2372	rundll32.exe	30
PID 2372 wrote to memory of 2972	2372	rundll32.exe	30
PID 2372 wrote to memory of 2972	2372	rundll32.exe	30
PID 2372 wrote to memory of 2972	2372	rundll32.exe	30
PID 2372 wrote to memory of 2972	2372	rundll32.exe	30
PID 2372 wrote to memory of 2972	2372	rundll32.exe	30
PID 2372 wrote to memory of 2972	2372	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\402509a678fd4b0e6941a8e3489caaba_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\402509a678fd4b0e6941a8e3489caaba_JaffaCakes118.dll,#1
  2⤵
  PID:2972

memory/2972-0-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/2972-3-0x0000000010001000-0x000000001001A000-memory.dmp

Filesize
100KB

Download
memory/2972-2-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/2972-1-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download