ea255187b9d57815d14430653cb43b99ba79b5791c349ea597bc0ad13e96854d

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 10:24

Target

4de6b8d8a980efc1d4edcd19f98c524a_JaffaCakes118.dll
Size

102KB
MD5

4de6b8d8a980efc1d4edcd19f98c524a
SHA1

110728e9cc81d73c6bdd420f79875b0205566886
SHA256

ea255187b9d57815d14430653cb43b99ba79b5791c349ea597bc0ad13e96854d
SHA512

29f1c88896ba3753c08104aba92a8dbe063b90998c9801479ff09dffb39969161276e069de1fce3d3de4454e745523992a4d47ee75d8a67fcdf5387592b9ee5c
SSDEEP

1536:Cx3/K2rb4l/8V3rQIr7h/gedEbYPohC184eWzYZ6Db6D+6PSqe/:03/KeW8V3rQs9L6W84eWcZ2+D+6Sj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2884	2868	rundll32.exe	30
PID 2868 wrote to memory of 2884	2868	rundll32.exe	30
PID 2868 wrote to memory of 2884	2868	rundll32.exe	30
PID 2868 wrote to memory of 2884	2868	rundll32.exe	30
PID 2868 wrote to memory of 2884	2868	rundll32.exe	30
PID 2868 wrote to memory of 2884	2868	rundll32.exe	30
PID 2868 wrote to memory of 2884	2868	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4de6b8d8a980efc1d4edcd19f98c524a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4de6b8d8a980efc1d4edcd19f98c524a_JaffaCakes118.dll,#1
  2⤵
  PID:2884

memory/2884-3-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2884-2-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2884-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2884-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download