b1d246cc17cde0f5346a8cacf4660b4e948855397f7a1d8d82e2e96d2e66c539

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 01:22

Target

59e34f2848c78250147899fe12b3a8b3_JaffaCakes118.dll
Size

25KB
MD5

59e34f2848c78250147899fe12b3a8b3
SHA1

743739e39c006f55932dee3edc58950e104cd5b0
SHA256

b1d246cc17cde0f5346a8cacf4660b4e948855397f7a1d8d82e2e96d2e66c539
SHA512

4302be0a83690943f6a6308e16651dce6f50a0ab9c9d8c8f3495ac01fbc81ed3b8c3462615d44d84355d3550b90865aa15f2c4f65db8f619d999cda27df63f64
SSDEEP

768:yk2Zuex9DEtQbO9811aMOFdOJKM+27siuVre:DeZOOaMOFdOz7si

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59e34f2848c78250147899fe12b3a8b3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59e34f2848c78250147899fe12b3a8b3_JaffaCakes118.dll,#1
  2⤵
  PID:2760

memory/2760-3-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2760-2-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2760-1-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2760-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download