676662232fae31eb8b900017c49868ae8271e9dcc8300d603070e0aa194d75a0

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 17:25

Target

46cc1fc91f12e1b76f6ff0651a2ca0bc_JaffaCakes118.dll
Size

63KB
MD5

46cc1fc91f12e1b76f6ff0651a2ca0bc
SHA1

9f944552a73ea11cab3e4985c8517a7654ca4eaf
SHA256

676662232fae31eb8b900017c49868ae8271e9dcc8300d603070e0aa194d75a0
SHA512

e124a07e708b1cb7974653486234b71a5a5ead08a62090ac15a0d12dcbd50965544d8d61c2ec92e49d7c05b017b522421f8afd0209dc0843278db880a64f4857
SSDEEP

1536:qQC0WsVbggSCwQiTVlvsm6LPAcYZCT7cPQzGC:5CaVb2b8LPAcbcPQz7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2076	2624	rundll32.exe	30
PID 2624 wrote to memory of 2076	2624	rundll32.exe	30
PID 2624 wrote to memory of 2076	2624	rundll32.exe	30
PID 2624 wrote to memory of 2076	2624	rundll32.exe	30
PID 2624 wrote to memory of 2076	2624	rundll32.exe	30
PID 2624 wrote to memory of 2076	2624	rundll32.exe	30
PID 2624 wrote to memory of 2076	2624	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46cc1fc91f12e1b76f6ff0651a2ca0bc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\46cc1fc91f12e1b76f6ff0651a2ca0bc_JaffaCakes118.dll,#1
  2⤵
  PID:2076

memory/2076-0-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download