95aba8aa995b1b4688efcab21f63bdffe8c65ea1ba13e36008aecc5477b1e273

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 10:50

Target

457da8851019f6f35adf4c5c86155a0c_JaffaCakes118.dll
Size

179KB
MD5

457da8851019f6f35adf4c5c86155a0c
SHA1

8a9963f9f23eaadabffa5190511ab589e8daef8f
SHA256

95aba8aa995b1b4688efcab21f63bdffe8c65ea1ba13e36008aecc5477b1e273
SHA512

0374467ef4657beb7c8093bb06d4863966278253aa46cafde7aeff3f016cb083bb418f5ff9973b74c860b7fececfc9968295598a2d96c234c0ec0b6bc3c65714
SSDEEP

3072:ruw+CQ2bpfKOR1zV/WfOOGAbrzHJE04Yph24d2kByOiXnSBGafogriC9BDMqqDLi:r9+CQ2bpfpR1B/WfOOGAbrzHJE04Yphp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2580	2548	rundll32.exe	30
PID 2548 wrote to memory of 2580	2548	rundll32.exe	30
PID 2548 wrote to memory of 2580	2548	rundll32.exe	30
PID 2548 wrote to memory of 2580	2548	rundll32.exe	30
PID 2548 wrote to memory of 2580	2548	rundll32.exe	30
PID 2548 wrote to memory of 2580	2548	rundll32.exe	30
PID 2548 wrote to memory of 2580	2548	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\457da8851019f6f35adf4c5c86155a0c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\457da8851019f6f35adf4c5c86155a0c_JaffaCakes118.dll,#1
  2⤵
  PID:2580

memory/2580-0-0x000000001001E000-0x000000001002D000-memory.dmp

Filesize
60KB

Download
memory/2580-5-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/2580-1-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/2580-6-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download