f19f3af31c102bb600bdd5f71dad9d95846a981671db68f35daa9d24055e422a

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 15:32

Target

466e0f1012511123639c08c9299fb8aa_JaffaCakes118.dll
Size

135KB
MD5

466e0f1012511123639c08c9299fb8aa
SHA1

951a8eac769d8b7d438d5fde8e1cf8c926da6eea
SHA256

f19f3af31c102bb600bdd5f71dad9d95846a981671db68f35daa9d24055e422a
SHA512

a25ebb266c4fc31658b601428602bfc1125ebd12cd55b6a3107e4681034a96d332b7338ac1def3069cfc886566d076a3ab760279fe3f99d08729301f67f78213
SSDEEP

3072:S+4bMXkhr/qsZ8TZMfvft5zh/y1XeuoSMqqDLy/1yd:SvbMXM8T+NpyXeDqqDLu1y

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2560	2440	rundll32.exe	30
PID 2440 wrote to memory of 2560	2440	rundll32.exe	30
PID 2440 wrote to memory of 2560	2440	rundll32.exe	30
PID 2440 wrote to memory of 2560	2440	rundll32.exe	30
PID 2440 wrote to memory of 2560	2440	rundll32.exe	30
PID 2440 wrote to memory of 2560	2440	rundll32.exe	30
PID 2440 wrote to memory of 2560	2440	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\466e0f1012511123639c08c9299fb8aa_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\466e0f1012511123639c08c9299fb8aa_JaffaCakes118.dll,#1
  2⤵
  PID:2560

memory/2560-0-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/2560-5-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/2560-4-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download