2dfe63f61806963a11343120137b77ebafa837934f7fab876de26f20571dd83a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 10:18

Target

4563ffaeb75e2abf95edc047a564922f_JaffaCakes118.dll
Size

96KB
MD5

4563ffaeb75e2abf95edc047a564922f
SHA1

150845c9b55a79221a2b6e722947c7f6f9851eae
SHA256

2dfe63f61806963a11343120137b77ebafa837934f7fab876de26f20571dd83a
SHA512

77feae2f050cffb040d145e837340e00d4e5b1d46d5b585713afcb5b0a835424f744f11bde877aff2d28bac5eccef724d409fafda3edff8fc976b8a8311650f5
SSDEEP

1536:7mv7NegBYUhirXQCK/blh6iOyKDr2hYtMU7x7YwR3:KhYUdXlc2K5z

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2584	2416	rundll32.exe	30
PID 2416 wrote to memory of 2584	2416	rundll32.exe	30
PID 2416 wrote to memory of 2584	2416	rundll32.exe	30
PID 2416 wrote to memory of 2584	2416	rundll32.exe	30
PID 2416 wrote to memory of 2584	2416	rundll32.exe	30
PID 2416 wrote to memory of 2584	2416	rundll32.exe	30
PID 2416 wrote to memory of 2584	2416	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4563ffaeb75e2abf95edc047a564922f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4563ffaeb75e2abf95edc047a564922f_JaffaCakes118.dll,#1
  2⤵
  PID:2584

memory/2584-4-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download
memory/2584-5-0x0000000010008000-0x0000000010019000-memory.dmp

Filesize
68KB

Download
memory/2584-0-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download
memory/2584-6-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download