1633ec86b9b213f2914a91ebec9ec8eb74780776fbc67f3934374f12d59aeb07

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 20:52

Target

4b59ed32ddd19add100ef0572ba42c70_JaffaCakes118.dll
Size

9KB
MD5

4b59ed32ddd19add100ef0572ba42c70
SHA1

3fc6e6a1b7226497142984fbfe0fe0190dbab769
SHA256

1633ec86b9b213f2914a91ebec9ec8eb74780776fbc67f3934374f12d59aeb07
SHA512

b092725b168b65211d6fd56ab040bea4f4744535c20cec5dc484c9b0b1843ef5138e82200547e562e8c02336946c23ba38beaba85f98eee90be6994304a57be9
SSDEEP

96:q1V7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG34b:kuwEt8rsTUtPLzKNWSYWF4b

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2280	1908	rundll32.exe	31
PID 1908 wrote to memory of 2280	1908	rundll32.exe	31
PID 1908 wrote to memory of 2280	1908	rundll32.exe	31
PID 1908 wrote to memory of 2280	1908	rundll32.exe	31
PID 1908 wrote to memory of 2280	1908	rundll32.exe	31
PID 1908 wrote to memory of 2280	1908	rundll32.exe	31
PID 1908 wrote to memory of 2280	1908	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b59ed32ddd19add100ef0572ba42c70_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b59ed32ddd19add100ef0572ba42c70_JaffaCakes118.dll,#1
  2⤵
  PID:2280

memory/2280-3-0x00000000000B0000-0x00000000000B7000-memory.dmp

Filesize
28KB

Download
memory/2280-2-0x00000000000A0000-0x00000000000A7000-memory.dmp

Filesize
28KB

Download
memory/2280-1-0x00000000000A0000-0x00000000000A7000-memory.dmp

Filesize
28KB

Download
memory/2280-0-0x00000000000A0000-0x00000000000A7000-memory.dmp

Filesize
28KB

Download