6e0d49a889973ba876cd318494f12d883d51d4cb87c76d118db38a0e2fb8afdf

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 06:17

Target

5ac845a4103e2daa2ed06b0b936eccd8_JaffaCakes118.dll
Size

313KB
MD5

5ac845a4103e2daa2ed06b0b936eccd8
SHA1

2e16ab5bd27e7e92a9eb436a502970fee8b01ab3
SHA256

6e0d49a889973ba876cd318494f12d883d51d4cb87c76d118db38a0e2fb8afdf
SHA512

3b83e1e0e24446d61560745469c5b5de3e8a490c341d8eb88be716710d13c8a48c84fd15edbfd3135cd9487f8d5c8c765a2b3a9cb66189da6378d96f38164c8c
SSDEEP

6144:D/3Ewx7JmT+YVH2AiPWs9eOoyOhFiLWbld1KW7sWq7gJ:D/35YT+Px+sLQMLW5d8WAZgJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2004	2220	rundll32.exe	30
PID 2220 wrote to memory of 2004	2220	rundll32.exe	30
PID 2220 wrote to memory of 2004	2220	rundll32.exe	30
PID 2220 wrote to memory of 2004	2220	rundll32.exe	30
PID 2220 wrote to memory of 2004	2220	rundll32.exe	30
PID 2220 wrote to memory of 2004	2220	rundll32.exe	30
PID 2220 wrote to memory of 2004	2220	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ac845a4103e2daa2ed06b0b936eccd8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ac845a4103e2daa2ed06b0b936eccd8_JaffaCakes118.dll,#1
  2⤵
  PID:2004

memory/2004-0-0x0000000010000000-0x000000001009D000-memory.dmp

Filesize
628KB

Download
memory/2004-1-0x0000000010000000-0x000000001009D000-memory.dmp

Filesize
628KB

Download