d834935e508416f7be8d4aacab08fa9318b4f3ad6086a3e747dc09720dc4dfba

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 11:38

Target

499d81cec21c1b9135c56da941b9d1a9_JaffaCakes118.dll
Size

221KB
MD5

499d81cec21c1b9135c56da941b9d1a9
SHA1

b998cd05dd5aa0cdf13ca24f11c1b8eaa888c67f
SHA256

d834935e508416f7be8d4aacab08fa9318b4f3ad6086a3e747dc09720dc4dfba
SHA512

4c88073000a9727458cf879f998597bda7fbd9c80c30a9b88b2a0ba1a5d5601d4ba761b68412147280d31b414931a08d8acb4dc52442a8a2b8f56f703bec71db
SSDEEP

6144:hX+lH+os/EhtqWwVlfyiYzcnvKfoFMkRyZf+:0lLcOtqWwDfdYzhCMWyl+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\499d81cec21c1b9135c56da941b9d1a9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\499d81cec21c1b9135c56da941b9d1a9_JaffaCakes118.dll,#1
  2⤵
  PID:1864

memory/1864-2-0x0000000074640000-0x000000007467A000-memory.dmp

Filesize
232KB

Download
memory/1864-1-0x000000007464D000-0x0000000074676000-memory.dmp

Filesize
164KB

Download
memory/1864-0-0x0000000074640000-0x000000007467A000-memory.dmp

Filesize
232KB

Download
memory/1864-3-0x0000000000270000-0x0000000000274000-memory.dmp

Filesize
16KB

Download
memory/1864-4-0x00000000001F0000-0x0000000000215000-memory.dmp

Filesize
148KB

Download
memory/1864-5-0x0000000074640000-0x000000007467A000-memory.dmp

Filesize
232KB

Download
memory/1864-6-0x00000000001F0000-0x0000000000215000-memory.dmp

Filesize
148KB

Download
memory/1864-7-0x00000000001F0000-0x0000000000215000-memory.dmp

Filesize
148KB

Download