2ab6326b8ff66cae5d3652dc0b74f3487ce05c7ce5951da700e5fd0682f1b808

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 18:05

Target

4ace65dd03f5bdd7d19f6c977ccb1b77_JaffaCakes118.dll
Size

6KB
MD5

4ace65dd03f5bdd7d19f6c977ccb1b77
SHA1

7be4d911138668234b9c120844b5e62fb1147aef
SHA256

2ab6326b8ff66cae5d3652dc0b74f3487ce05c7ce5951da700e5fd0682f1b808
SHA512

ff0c621f8c3f22fff9aa6280fcaf443bde189012ae099bef577d33d47be85faa5596fa492a805f3e944d8522bdb924d748a23e04f1395d608c3eeaac402d1b68
SSDEEP

48:aGy7MN4cpSGAXbIni1kvNs6ztutiKIZWiwQTnU5WwG2QozbC:xB4c4G6bn1k1sw0EW3enIWwGqb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2420	2692	rundll32.exe	30
PID 2692 wrote to memory of 2420	2692	rundll32.exe	30
PID 2692 wrote to memory of 2420	2692	rundll32.exe	30
PID 2692 wrote to memory of 2420	2692	rundll32.exe	30
PID 2692 wrote to memory of 2420	2692	rundll32.exe	30
PID 2692 wrote to memory of 2420	2692	rundll32.exe	30
PID 2692 wrote to memory of 2420	2692	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ace65dd03f5bdd7d19f6c977ccb1b77_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ace65dd03f5bdd7d19f6c977ccb1b77_JaffaCakes118.dll,#1
  2⤵
  PID:2420

memory/2420-1-0x00000000001A0000-0x00000000001A6000-memory.dmp

Filesize
24KB

Download
memory/2420-3-0x00000000001B0000-0x00000000001B6000-memory.dmp

Filesize
24KB

Download
memory/2420-0-0x00000000001A0000-0x00000000001A6000-memory.dmp

Filesize
24KB

Download
memory/2420-2-0x00000000001A0000-0x00000000001A6000-memory.dmp

Filesize
24KB

Download