8adb5ffcd1d059df7213632f7197fa1d3d2ee6dcd337180d8d1c8ea1fa13a33c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 15:59

Target

46852b54d3ce0818c95c213bc9a79653_JaffaCakes118.dll
Size

31KB
MD5

46852b54d3ce0818c95c213bc9a79653
SHA1

84bc919ad49106755a462caf657ef9cf2d6bafa0
SHA256

8adb5ffcd1d059df7213632f7197fa1d3d2ee6dcd337180d8d1c8ea1fa13a33c
SHA512

5fe4741ef29a81dafd0319e9be4fa20cb467841a932b7986105e22da13e9e9aced010919cc62afc46cf43c3f242f7faada93efc4fc3c51c2f806fd1418c14e66
SSDEEP

768:m49vZaEAlT9oN0JI4csCTneKwz6eVKxFOOZ:m49Eh6yJBZJ8xFOO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2360	2088	rundll32.exe	31
PID 2088 wrote to memory of 2360	2088	rundll32.exe	31
PID 2088 wrote to memory of 2360	2088	rundll32.exe	31
PID 2088 wrote to memory of 2360	2088	rundll32.exe	31
PID 2088 wrote to memory of 2360	2088	rundll32.exe	31
PID 2088 wrote to memory of 2360	2088	rundll32.exe	31
PID 2088 wrote to memory of 2360	2088	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46852b54d3ce0818c95c213bc9a79653_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\46852b54d3ce0818c95c213bc9a79653_JaffaCakes118.dll,#1
  2⤵
  PID:2360

memory/2360-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2360-3-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2360-2-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2360-1-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download