f6b8eb6d1b3a5d6bdc06f3b28b2671be8e1b9e6dbad6c53380770f637ab26c90

Analysis

max time kernel
17s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 14:03

Target

49fdfa3c481e744de17a7eca78fd0b8e_JaffaCakes118.dll
Size

468KB
MD5

49fdfa3c481e744de17a7eca78fd0b8e
SHA1

0cfef462da23b6dfe43105bd219d225bc0f846f0
SHA256

f6b8eb6d1b3a5d6bdc06f3b28b2671be8e1b9e6dbad6c53380770f637ab26c90
SHA512

16060a8648184f13e714197a99e6b7e06954584ef3820f907c2dd3b9bafca541ee5aa2737ff3615a606392069798968c40611472627879a0dcacd4ea668d3a74
SSDEEP

12288:obuHLh9PY+XFnSQrYeGtgFD8x3nJIbooqHL3M5w0pCWFEHd7:obD+UQrYeGzTIASpCWF+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 828	1732	rundll32.exe	29
PID 1732 wrote to memory of 828	1732	rundll32.exe	29
PID 1732 wrote to memory of 828	1732	rundll32.exe	29
PID 1732 wrote to memory of 828	1732	rundll32.exe	29
PID 1732 wrote to memory of 828	1732	rundll32.exe	29
PID 1732 wrote to memory of 828	1732	rundll32.exe	29
PID 1732 wrote to memory of 828	1732	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\49fdfa3c481e744de17a7eca78fd0b8e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\49fdfa3c481e744de17a7eca78fd0b8e_JaffaCakes118.dll,#1
  2⤵
  PID:828

memory/828-0-0x0000000001F20000-0x0000000002012000-memory.dmp

Filesize
968KB

Download
memory/828-1-0x0000000001F20000-0x0000000002012000-memory.dmp

Filesize
968KB

Download