1a8ff95b23ce00d5f903f7cb467ea38ccb2f0e2c6e785dd323cea3f97a4a64eb

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 04:46

Target

4846e26658881ad4d03410754f601308_JaffaCakes118.dll
Size

48KB
MD5

4846e26658881ad4d03410754f601308
SHA1

aaa7eee797b1320d9031f4d01a7c83e886603aa0
SHA256

1a8ff95b23ce00d5f903f7cb467ea38ccb2f0e2c6e785dd323cea3f97a4a64eb
SHA512

7bb83414887f725f2ad656418bbfa9b88ac56d5f0c0019c1c320692fea346ec8f2a4e03858dd565b16bd6383023ade3cc422b2dc740a739ba780ef78d1da297d
SSDEEP

768:IykIwePd8g7dHJS6Jv8AuaWy5tz1vtg3p/Hb5Pf1C0uNl1LKts6BxyK:IykzkagTPJv8wWEtRVghVPNuNqJ+K

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2128	2052	rundll32.exe	30
PID 2052 wrote to memory of 2128	2052	rundll32.exe	30
PID 2052 wrote to memory of 2128	2052	rundll32.exe	30
PID 2052 wrote to memory of 2128	2052	rundll32.exe	30
PID 2052 wrote to memory of 2128	2052	rundll32.exe	30
PID 2052 wrote to memory of 2128	2052	rundll32.exe	30
PID 2052 wrote to memory of 2128	2052	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4846e26658881ad4d03410754f601308_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4846e26658881ad4d03410754f601308_JaffaCakes118.dll,#1
  2⤵
  PID:2128

memory/2128-3-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2128-2-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2128-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2128-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download