ba47cf08b611aa0aaf6b0b405a00ff2583d4650fe27f1a5fa4e4b36f28693d59

Analysis

max time kernel
14s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 23:32

Target

47410546a8ab3bb22c180f52965b4674_JaffaCakes118.dll
Size

46KB
MD5

47410546a8ab3bb22c180f52965b4674
SHA1

400d04f61e35e9a115fa0b39352c779b684c9ea5
SHA256

ba47cf08b611aa0aaf6b0b405a00ff2583d4650fe27f1a5fa4e4b36f28693d59
SHA512

7930cccc2857f5eae8616ee7bf8ec0fcd9b9c0ed5bc23db440a46e59c609f5ecd502f92053c6cebba58f3916dab4c8075a60f77126adaa9487b12156ceb8d4fa
SSDEEP

768:zMwOKtJuSuuGV/BgAhaPae/RT457K0EAILZf9e:zMhKtsSJ2/haPaeZTy7K0jQZ1e

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2464	1656	rundll32.exe	29
PID 1656 wrote to memory of 2464	1656	rundll32.exe	29
PID 1656 wrote to memory of 2464	1656	rundll32.exe	29
PID 1656 wrote to memory of 2464	1656	rundll32.exe	29
PID 1656 wrote to memory of 2464	1656	rundll32.exe	29
PID 1656 wrote to memory of 2464	1656	rundll32.exe	29
PID 1656 wrote to memory of 2464	1656	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47410546a8ab3bb22c180f52965b4674_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47410546a8ab3bb22c180f52965b4674_JaffaCakes118.dll,#1
  2⤵
  PID:2464

memory/2464-1-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2464-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download