e15dd92035487b20ecf393eebc20cb50583df02890ecc200791fc94c4de77f38

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 18:13

Target

46f32618ec037eddc93c211c2667b80e_JaffaCakes118.dll
Size

131KB
MD5

46f32618ec037eddc93c211c2667b80e
SHA1

53708be6a6a2796e7f93e268435072338ca8698e
SHA256

e15dd92035487b20ecf393eebc20cb50583df02890ecc200791fc94c4de77f38
SHA512

4c27d261bee682be67913e521a9ffa2133cfa107e94e31150a499859d7ee7a35a3e3d2093216a6b1734228c577a332823adb4e0d4d54ee5f8a721bd1fe6d0c75
SSDEEP

3072:DZW828VY4GgNpx6CfwUiYZ8tmYtxJSov8t9/5W:U8pZGgNXpfwUlZ88YPvi/5W

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2468	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46f32618ec037eddc93c211c2667b80e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\46f32618ec037eddc93c211c2667b80e_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2468

memory/2468-0-0x0000000000190000-0x00000000001B9000-memory.dmp

Filesize
164KB

Download
memory/2468-3-0x00000000001B8000-0x00000000001B9000-memory.dmp

Filesize
4KB

Download
memory/2468-2-0x0000000000190000-0x00000000001B9000-memory.dmp

Filesize
164KB

Download
memory/2468-1-0x0000000000190000-0x00000000001B9000-memory.dmp

Filesize
164KB

Download