a48087897589df9d54c0c0a74eb65a3837dd1a44dd1f30b83cd4d90d4c91c3be

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 15:43

Target

5c94cbc5d8d3581bd6baecc00449af71_JaffaCakes118.dll
Size

85KB
MD5

5c94cbc5d8d3581bd6baecc00449af71
SHA1

d0f98d2f552c323c636e50d03ba393ae3f01e2e9
SHA256

a48087897589df9d54c0c0a74eb65a3837dd1a44dd1f30b83cd4d90d4c91c3be
SHA512

8cc729442b50c4c583da72210bffb96d028cc980799a269e4ff5cff19fab57a778715e9d1da02ca604e7def36bf82b27f9d2eee11499949db2edd8d9c0d3d827
SSDEEP

1536:SQe+3LwkeQCie0A/fWQ2yLYke3pLDsyXv19oGTsZ+cDSR03SkeOCZ+liWBn+gRtt:SQj3AGo+Qxe5LFtDsYcDSRsSx7ZC5+S/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 688	2152	rundll32.exe	29
PID 2152 wrote to memory of 688	2152	rundll32.exe	29
PID 2152 wrote to memory of 688	2152	rundll32.exe	29
PID 2152 wrote to memory of 688	2152	rundll32.exe	29
PID 2152 wrote to memory of 688	2152	rundll32.exe	29
PID 2152 wrote to memory of 688	2152	rundll32.exe	29
PID 2152 wrote to memory of 688	2152	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c94cbc5d8d3581bd6baecc00449af71_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c94cbc5d8d3581bd6baecc00449af71_JaffaCakes118.dll,#1
  2⤵
  PID:688

memory/688-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/688-3-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/688-2-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/688-1-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download