b9e68954ee6e3d41a1ebc94203353a69566d7b1c4ea4e83849ffbd6b36adfb3c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 18:14

Target

4ad645e64f404517df631f477c2a7721_JaffaCakes118.dll
Size

535KB
MD5

4ad645e64f404517df631f477c2a7721
SHA1

2cd4ca1fc267d58eb1a3de46ddb3041b6c462746
SHA256

b9e68954ee6e3d41a1ebc94203353a69566d7b1c4ea4e83849ffbd6b36adfb3c
SHA512

933a899a08452303da760c03db89f74742be2542cfc07525b8828a81906f2983232418caa2b0816a855d523e91f3e36069c2a76abc9a820b05209a4bc5ab221d
SSDEEP

12288:xG1WFjvv5F+xBewCPiErdF3Z4mxxp81lEH9P05Zi4:xdFjvv5F+dCPBQmXa12HN6Zi4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1824	1888	rundll32.exe	31
PID 1888 wrote to memory of 1824	1888	rundll32.exe	31
PID 1888 wrote to memory of 1824	1888	rundll32.exe	31
PID 1888 wrote to memory of 1824	1888	rundll32.exe	31
PID 1888 wrote to memory of 1824	1888	rundll32.exe	31
PID 1888 wrote to memory of 1824	1888	rundll32.exe	31
PID 1888 wrote to memory of 1824	1888	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ad645e64f404517df631f477c2a7721_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ad645e64f404517df631f477c2a7721_JaffaCakes118.dll,#1
  2⤵
  PID:1824

memory/1824-0-0x0000000000830000-0x0000000000951000-memory.dmp

Filesize
1.1MB

Download
memory/1824-1-0x0000000000830000-0x0000000000951000-memory.dmp

Filesize
1.1MB

Download
memory/1824-3-0x0000000000320000-0x0000000000374000-memory.dmp

Filesize
336KB

Download
memory/1824-2-0x0000000000901000-0x0000000000902000-memory.dmp

Filesize
4KB

Download