1c4fd3dd0a2d9c3ccc9d024c81c12421870069fb5a03da6f0c37dac974394cdd

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 10:48

Target

49741fdf01e52f4c42c2549fd5ba54ce_JaffaCakes118.dll
Size

168KB
MD5

49741fdf01e52f4c42c2549fd5ba54ce
SHA1

551686242f723bb8560ad63bf74c1049ea0c6efc
SHA256

1c4fd3dd0a2d9c3ccc9d024c81c12421870069fb5a03da6f0c37dac974394cdd
SHA512

93fb08d5c7d3738e767a3f4afe214b828955bbaed51e6ef2a3efd99a533c6a89ff1607b4132a0ad1c634ceee61808084393a4a7fbe9a19985eadfe98e48f0f03
SSDEEP

3072:k1IM6ptoGzKtuNMSL1KyY6cDcw6IKPhjoXfhFYex1j2UuZiVeqUL4vlX5h3sqm:wITtzc8xt1PmXfrbl2dqUMvl5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 2092	1880	rundll32.exe	31
PID 1880 wrote to memory of 2092	1880	rundll32.exe	31
PID 1880 wrote to memory of 2092	1880	rundll32.exe	31
PID 1880 wrote to memory of 2092	1880	rundll32.exe	31
PID 1880 wrote to memory of 2092	1880	rundll32.exe	31
PID 1880 wrote to memory of 2092	1880	rundll32.exe	31
PID 1880 wrote to memory of 2092	1880	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\49741fdf01e52f4c42c2549fd5ba54ce_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\49741fdf01e52f4c42c2549fd5ba54ce_JaffaCakes118.dll,#1
  2⤵
  PID:2092

memory/2092-1-0x00000000001D0000-0x00000000001E3000-memory.dmp

Filesize
76KB

Download
memory/2092-2-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download
memory/2092-3-0x0000000074A20000-0x0000000074A2F000-memory.dmp

Filesize
60KB

Download