2153b145f6e75eb4de74b088a6b78ba936f24795b20adfe3984d8815d0550678

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 05:53

Target

5ab67ab200226cddb2640aa58f79aab5_JaffaCakes118.dll
Size

67KB
MD5

5ab67ab200226cddb2640aa58f79aab5
SHA1

aecb9edc0f745cfecc7b5fc738909217af6a86c9
SHA256

2153b145f6e75eb4de74b088a6b78ba936f24795b20adfe3984d8815d0550678
SHA512

afc72d741dd2041f83323c58e911748639b6fc74f9b4dc0692706fb930b6403e3235bde280bbd0f0f86adb930242730166e50c8f4ba6227069eed5340b290495
SSDEEP

1536:Wnk9Mv6qHlSSnpx83sB5uqNTyQkjXGr25NcaE+Oj:KAKkSnMS4iVuXC25NcaTO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1480	2208	rundll32.exe	29
PID 2208 wrote to memory of 1480	2208	rundll32.exe	29
PID 2208 wrote to memory of 1480	2208	rundll32.exe	29
PID 2208 wrote to memory of 1480	2208	rundll32.exe	29
PID 2208 wrote to memory of 1480	2208	rundll32.exe	29
PID 2208 wrote to memory of 1480	2208	rundll32.exe	29
PID 2208 wrote to memory of 1480	2208	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ab67ab200226cddb2640aa58f79aab5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ab67ab200226cddb2640aa58f79aab5_JaffaCakes118.dll,#1
  2⤵
  PID:1480

memory/1480-3-0x0000000000130000-0x000000000013F000-memory.dmp

Filesize
60KB

Download
memory/1480-2-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/1480-1-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/1480-0-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download