91c0dcc1b916f8770e22ef49390d1c9f699862127dfa9a00d254a5f278d2ae9b

Analysis

max time kernel
17s
max time network
20s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 16:19

Target

4695fd125eda3189fce0585100c8db04_JaffaCakes118.dll
Size

72KB
MD5

4695fd125eda3189fce0585100c8db04
SHA1

26494eda68e9f027ed4d0d022fdd13d3c72d5b97
SHA256

91c0dcc1b916f8770e22ef49390d1c9f699862127dfa9a00d254a5f278d2ae9b
SHA512

d6e85ed99fce661ceffb73df2449f72c9818c6935a77111cb8b96bc171af2541dac2337feb40b4901ddb1fac9b484ffe265bc89e6e82fca497e9182e78e36917
SSDEEP

1536:YRMaoGWbOvAIcN/Tw/RJkToNJnAPMT1oWGfHhQT3C:YRMaoQtaw/RJe4lRJnkHqTS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 1312	1896	rundll32.exe	29
PID 1896 wrote to memory of 1312	1896	rundll32.exe	29
PID 1896 wrote to memory of 1312	1896	rundll32.exe	29
PID 1896 wrote to memory of 1312	1896	rundll32.exe	29
PID 1896 wrote to memory of 1312	1896	rundll32.exe	29
PID 1896 wrote to memory of 1312	1896	rundll32.exe	29
PID 1896 wrote to memory of 1312	1896	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4695fd125eda3189fce0585100c8db04_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4695fd125eda3189fce0585100c8db04_JaffaCakes118.dll,#1
  2⤵
  PID:1312

memory/1312-3-0x0000000010030000-0x0000000010031000-memory.dmp

Filesize
4KB

Download
memory/1312-2-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download
memory/1312-1-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download
memory/1312-0-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download