eed9f54762b507ff8196af6a613cdfeae7673dafcd23252d4f82177bf980e85c

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 01:09

Target

59da30f787728cdd2ea74e9f4b86c9e7_JaffaCakes118.dll
Size

56KB
MD5

59da30f787728cdd2ea74e9f4b86c9e7
SHA1

4dba94b870eb551107457cc057164938eadde33f
SHA256

eed9f54762b507ff8196af6a613cdfeae7673dafcd23252d4f82177bf980e85c
SHA512

f915f51a2435bbac48951a7fb03ecd908c8d806196a0198b4157872e6c0db5e82af9b93dcfba58ca3c001491e5e778d1cfee873380a5b4623ef6289487b184da
SSDEEP

1536:vSwlKC19SnIhSmSWDA42jsn2PfI/93CYNEkVfePM:nAMSKAIn24/9f2FM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2036	1944	rundll32.exe	29
PID 1944 wrote to memory of 2036	1944	rundll32.exe	29
PID 1944 wrote to memory of 2036	1944	rundll32.exe	29
PID 1944 wrote to memory of 2036	1944	rundll32.exe	29
PID 1944 wrote to memory of 2036	1944	rundll32.exe	29
PID 1944 wrote to memory of 2036	1944	rundll32.exe	29
PID 1944 wrote to memory of 2036	1944	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59da30f787728cdd2ea74e9f4b86c9e7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59da30f787728cdd2ea74e9f4b86c9e7_JaffaCakes118.dll,#1
  2⤵
  PID:2036

memory/2036-0-0x0000000010000000-0x0000000010682000-memory.dmp

Filesize
6.5MB

Download
memory/2036-1-0x0000000010000000-0x0000000010682000-memory.dmp

Filesize
6.5MB

Download
memory/2036-2-0x0000000010000000-0x0000000010682000-memory.dmp

Filesize
6.5MB

Download
memory/2036-3-0x0000000010680000-0x0000000010681000-memory.dmp

Filesize
4KB

Download