8002c59f724fe790b2534888c6ff6a90fbf89387f13db268ea896074b5594fc1

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 01:57

Target

5a031b1f01db6c66f64f2c58f25cbd5c_JaffaCakes118.dll
Size

84KB
MD5

5a031b1f01db6c66f64f2c58f25cbd5c
SHA1

bbec41efd207d7d6b6f1d6e2bc508610da9594f2
SHA256

8002c59f724fe790b2534888c6ff6a90fbf89387f13db268ea896074b5594fc1
SHA512

a61d96a0dba0bbf331e0d72be40345155076c21f7047c1c9f3d6c0647c70af2c3eb1ce9ce0ea49e1ee004be84d240a18736fd7f010ebbe0ce27fd60f22743055
SSDEEP

1536:uN+UKZp/Qg1Beo/GcuUDmo7sd1O0stzXOHYCKF0LeJkvsqIFJvkNIV8b:QbKQg1GIm2a1/sZXAMF0LeJk0qIUqV8b

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2320	2316	rundll32.exe	30
PID 2316 wrote to memory of 2320	2316	rundll32.exe	30
PID 2316 wrote to memory of 2320	2316	rundll32.exe	30
PID 2316 wrote to memory of 2320	2316	rundll32.exe	30
PID 2316 wrote to memory of 2320	2316	rundll32.exe	30
PID 2316 wrote to memory of 2320	2316	rundll32.exe	30
PID 2316 wrote to memory of 2320	2316	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a031b1f01db6c66f64f2c58f25cbd5c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a031b1f01db6c66f64f2c58f25cbd5c_JaffaCakes118.dll,#1
  2⤵
  PID:2320

memory/2320-2-0x000000000028A000-0x000000000028B000-memory.dmp

Filesize
4KB

Download
memory/2320-1-0x0000000000250000-0x000000000028D000-memory.dmp

Filesize
244KB

Download
memory/2320-0-0x0000000000250000-0x000000000028D000-memory.dmp

Filesize
244KB

Download