68897425418b02bafb963c1c18a3dfa15fa17e5b838df5f7d8e6751ee2f4665c

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 02:12

Target

47c8cb939aee9a5204fb8c0bb7f79fa9_JaffaCakes118.dll
Size

233KB
MD5

47c8cb939aee9a5204fb8c0bb7f79fa9
SHA1

bb7ee8cb7e50b42f94db4a7829d7ba0912091969
SHA256

68897425418b02bafb963c1c18a3dfa15fa17e5b838df5f7d8e6751ee2f4665c
SHA512

deb17e982dfd0d4813ee63792ac76ff936bea3445b8eb564a9f63192d64d18ae85bda3d2fe1834712359fb4373f8eaf315914c59f6061099f3c68b46e8c9dbb7
SSDEEP

6144:0t3D6K5UxIXWw6n0/QKzyIeWiLHYrfctLJJJkp4RsFNi0O:0FCxgWw9QKz/iLHYroTJkpQsFNi0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1704	1724	rundll32.exe	30
PID 1724 wrote to memory of 1704	1724	rundll32.exe	30
PID 1724 wrote to memory of 1704	1724	rundll32.exe	30
PID 1724 wrote to memory of 1704	1724	rundll32.exe	30
PID 1724 wrote to memory of 1704	1724	rundll32.exe	30
PID 1724 wrote to memory of 1704	1724	rundll32.exe	30
PID 1724 wrote to memory of 1704	1724	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47c8cb939aee9a5204fb8c0bb7f79fa9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47c8cb939aee9a5204fb8c0bb7f79fa9_JaffaCakes118.dll,#1
  2⤵
  PID:1704

memory/1704-1-0x0000000001F80000-0x0000000002094000-memory.dmp

Filesize
1.1MB

Download
memory/1704-0-0x0000000001F80000-0x0000000002094000-memory.dmp

Filesize
1.1MB

Download