6da5aa385b7fefc833782a084c8eb5ed6d1d01d1c585652aae30247ec32e46b1

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 05:05

Target

446bd5b9a1aa531982641fb9d154e105_JaffaCakes118.dll
Size

47KB
MD5

446bd5b9a1aa531982641fb9d154e105
SHA1

cda48201c499ac0e245c69dae16a2ded8f577c66
SHA256

6da5aa385b7fefc833782a084c8eb5ed6d1d01d1c585652aae30247ec32e46b1
SHA512

9b18e2c00e2cc9bb513d4e6e8e4f378fcefe69d34d850a49a2dab1e923363501fac0d744a3e2619a2858a815e67e05068c77b74b1575830a232610ff06ccb888
SSDEEP

768:w4ixFYqQlVuDRubmpKWHPb+uV6kH3OcOhnvxbSblDSODxelBCay6:/0YLVuduhS+sFXsnpWb9/DxelPZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2100	2224	rundll32.exe	30
PID 2224 wrote to memory of 2100	2224	rundll32.exe	30
PID 2224 wrote to memory of 2100	2224	rundll32.exe	30
PID 2224 wrote to memory of 2100	2224	rundll32.exe	30
PID 2224 wrote to memory of 2100	2224	rundll32.exe	30
PID 2224 wrote to memory of 2100	2224	rundll32.exe	30
PID 2224 wrote to memory of 2100	2224	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\446bd5b9a1aa531982641fb9d154e105_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\446bd5b9a1aa531982641fb9d154e105_JaffaCakes118.dll,#1
  2⤵
  PID:2100

memory/2100-3-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2100-2-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2100-1-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2100-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download