89f8198a51fdb89faf28e124e77c29f9c67d8a45d5126354644460dc013bc55c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 07:58

Target

5b135f2298aacfeb7e8494193fc2278b_JaffaCakes118.dll
Size

15KB
MD5

5b135f2298aacfeb7e8494193fc2278b
SHA1

8b54f2b1281d2bd788fe959e485094aec1856010
SHA256

89f8198a51fdb89faf28e124e77c29f9c67d8a45d5126354644460dc013bc55c
SHA512

69b4debf8fa1ee46fe89d9e74089681f5ec1d7cf76c10d06cf7eb58a02bd879f3e83a6b58680d781adcbe7509329335965153f354ca7a0cde7a252c2823999a9
SSDEEP

384:TgTfF0GXfwBL4O/gJCP4iUsaYbBZTVI8M+A:TWm6fwBL4BCPqsaYNv/D

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1912	1700	rundll32.exe	31
PID 1700 wrote to memory of 1912	1700	rundll32.exe	31
PID 1700 wrote to memory of 1912	1700	rundll32.exe	31
PID 1700 wrote to memory of 1912	1700	rundll32.exe	31
PID 1700 wrote to memory of 1912	1700	rundll32.exe	31
PID 1700 wrote to memory of 1912	1700	rundll32.exe	31
PID 1700 wrote to memory of 1912	1700	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b135f2298aacfeb7e8494193fc2278b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b135f2298aacfeb7e8494193fc2278b_JaffaCakes118.dll,#1
  2⤵
  PID:1912

memory/1912-4-0x000000001000C000-0x000000001000D000-memory.dmp

Filesize
4KB

Download
memory/1912-3-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1912-2-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1912-1-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1912-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download