103d5c1f2054f008effdf3f4de5b6b5f194f05dbc977f59905ca7848a1ecdbb7

Analysis

max time kernel
140s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 22:47

Target

471be0853ad18f3bb9ff44aa6a98181e_JaffaCakes118.dll
Size

124KB
MD5

471be0853ad18f3bb9ff44aa6a98181e
SHA1

9c8b567c13f598203618597e72422ce010fc5879
SHA256

103d5c1f2054f008effdf3f4de5b6b5f194f05dbc977f59905ca7848a1ecdbb7
SHA512

eca367029c7c5d8c6767b81d837e52db275c868fa3ad0d08160839e755f8956f2dd4493ffb872f21842210efca3e71c3a3f616be65430b3bf0bbf3323eba730b
SSDEEP

3072:1yFs/eN9tIgw1Ijuw+4TRtBk3vOv2Wl5/b7jws:1es/eNYgw1Quiq3vOeWl5/b/

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
896	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 896	1140	rundll32.exe	30
PID 1140 wrote to memory of 896	1140	rundll32.exe	30
PID 1140 wrote to memory of 896	1140	rundll32.exe	30
PID 1140 wrote to memory of 896	1140	rundll32.exe	30
PID 1140 wrote to memory of 896	1140	rundll32.exe	30
PID 1140 wrote to memory of 896	1140	rundll32.exe	30
PID 1140 wrote to memory of 896	1140	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\471be0853ad18f3bb9ff44aa6a98181e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\471be0853ad18f3bb9ff44aa6a98181e_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:896

memory/896-0-0x00000000001A0000-0x00000000001C6000-memory.dmp

Filesize
152KB

Download
memory/896-1-0x00000000001A0000-0x00000000001C6000-memory.dmp

Filesize
152KB

Download
memory/896-2-0x00000000001A0000-0x00000000001C6000-memory.dmp

Filesize
152KB

Download
memory/896-4-0x00000000001A0000-0x00000000001C6000-memory.dmp

Filesize
152KB

Download
memory/896-5-0x00000000001A0000-0x00000000001C6000-memory.dmp

Filesize
152KB

Download
memory/896-7-0x00000000001A0000-0x00000000001C6000-memory.dmp

Filesize
152KB

Download
memory/896-8-0x00000000001A0000-0x00000000001C6000-memory.dmp

Filesize
152KB

Download
memory/896-10-0x00000000001A0000-0x00000000001C6000-memory.dmp

Filesize
152KB

Download
memory/896-11-0x00000000001A0000-0x00000000001C6000-memory.dmp

Filesize
152KB

Download
memory/896-13-0x00000000001A0000-0x00000000001C6000-memory.dmp

Filesize
152KB

Download
memory/896-14-0x00000000001A0000-0x00000000001C6000-memory.dmp

Filesize
152KB

Download