7b5614d46197678ff8b42d98db5bd308aa91ca62b71628008544041baea825b5

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 04:17

Target

5a6e5207ba543c99a9eac8db08d12494_JaffaCakes118.dll
Size

130KB
MD5

5a6e5207ba543c99a9eac8db08d12494
SHA1

49dc65ad3fb57f4273f1688625a1a4fc16a5d03f
SHA256

7b5614d46197678ff8b42d98db5bd308aa91ca62b71628008544041baea825b5
SHA512

5bdd2e7b7c32527421f07e2273c40e221ef4523062d88f019d5d7e8a369d29c3a225d1ffa797f50aa4f728beca847f5c559c4c264d93a815930215be7d180884
SSDEEP

3072:dcIJuSKBY1tiXJhyUIP4WX40aQvmSX1oDHWLKEMhr:dcIJuSEYWXJhyPP4WX42FobnEM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a6e5207ba543c99a9eac8db08d12494_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a6e5207ba543c99a9eac8db08d12494_JaffaCakes118.dll,#1
  2⤵
  PID:1864

memory/1864-1-0x0000000002240000-0x0000000002280000-memory.dmp

Filesize
256KB

Download
memory/1864-0-0x0000000002240000-0x0000000002280000-memory.dmp

Filesize
256KB

Download