1afdddc8257d044ab0af03c71b0136275c1aea303ee5c150bd68d9a6ba627e58

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 11:53

Target

45b31779e6e6fccad592fb752e88e0b2_JaffaCakes118.dll
Size

72KB
MD5

45b31779e6e6fccad592fb752e88e0b2
SHA1

aa47479d7460f21986a0a9a57f637d85e99ac4ec
SHA256

1afdddc8257d044ab0af03c71b0136275c1aea303ee5c150bd68d9a6ba627e58
SHA512

1fc0c4f516881ae29593257f3b9830501b889e6e88ec441b4038f67efc392fa16529e3851d02bc20e6f6450440eba0a395f745748b82a5d3a92bbddbf59ed2e0
SSDEEP

384:lI6kA+1Fu9CeU1K88W3ehzUUmU5ZKOjYXhcO59Plw4bMsIp70PdLCP/AVz3OCytE:lf9CD1KWWcekO0XhTde4gbTgx3ZuvK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 1996	484	rundll32.exe	31
PID 484 wrote to memory of 1996	484	rundll32.exe	31
PID 484 wrote to memory of 1996	484	rundll32.exe	31
PID 484 wrote to memory of 1996	484	rundll32.exe	31
PID 484 wrote to memory of 1996	484	rundll32.exe	31
PID 484 wrote to memory of 1996	484	rundll32.exe	31
PID 484 wrote to memory of 1996	484	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45b31779e6e6fccad592fb752e88e0b2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45b31779e6e6fccad592fb752e88e0b2_JaffaCakes118.dll,#1
  2⤵
  PID:1996

memory/1996-1-0x0000000000170000-0x0000000000182000-memory.dmp

Filesize
72KB

Download
memory/1996-3-0x0000000000180000-0x0000000000192000-memory.dmp

Filesize
72KB

Download
memory/1996-2-0x0000000000170000-0x0000000000182000-memory.dmp

Filesize
72KB

Download
memory/1996-0-0x0000000000170000-0x0000000000182000-memory.dmp

Filesize
72KB

Download
memory/1996-4-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download