1206ed8911f2104bdb60da72fe1e66d6dd7c6d3223e5f31e3dae7f84a0b75e4b

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 12:32

Target

45d4353b3cac76555c080a203584506f_JaffaCakes118.dll
Size

9KB
MD5

45d4353b3cac76555c080a203584506f
SHA1

be2169b6bc83083759b2d3264f00ca284fa2952b
SHA256

1206ed8911f2104bdb60da72fe1e66d6dd7c6d3223e5f31e3dae7f84a0b75e4b
SHA512

638679e5355b6ecf40083de5e64a2a229786cb64886df3bc518ffe6499e56de5929e2358ec5951d6f9561a5531497db742e49156a06595bd891a42162b17f07a
SSDEEP

192:Cl8VlRx9UV7aqW4ej5LxWPfmOKc7XHu1w8qx8D0Bymn1dJRiRWkgUwz8:m8V3x9sujxOKcDew8qeqtRizx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45d4353b3cac76555c080a203584506f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45d4353b3cac76555c080a203584506f_JaffaCakes118.dll,#1
  2⤵
  PID:1916

memory/1916-0-0x0000000025000000-0x0000000025016000-memory.dmp

Filesize
88KB

Download
memory/1916-2-0x0000000025000000-0x0000000025016000-memory.dmp

Filesize
88KB

Download
memory/1916-3-0x000000002500E000-0x000000002500F000-memory.dmp

Filesize
4KB

Download
memory/1916-1-0x0000000025000000-0x0000000025016000-memory.dmp

Filesize
88KB

Download