6f1bd13b8c7b30a4c38506c2537008846c73aacb40f46e1be36594166d4096ca

Analysis

max time kernel
15s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 05:20

Target

5f2cdb590f7e02bca7bd968bf1b4f899_JaffaCakes118.dll
Size

328KB
MD5

5f2cdb590f7e02bca7bd968bf1b4f899
SHA1

1498b45bcfb54c797d96e9f386ba8d860a53231f
SHA256

6f1bd13b8c7b30a4c38506c2537008846c73aacb40f46e1be36594166d4096ca
SHA512

919b1617775541b0d793169a6eb95a8ea61fdc9524127971d06b8b8462796d52192659942270eca402a59668d8bbe89edd872f38e8ce3950e9024404b30868a1
SSDEEP

6144:HfSG6C2aOymb+ce1M/Cs6HA3oGJYpWzBHcy85ktKEVQnMquAO4wakt:HfSG6C2aOymlGMjYdpWzp8SvVQnMqu9H

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f2cdb590f7e02bca7bd968bf1b4f899_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f2cdb590f7e02bca7bd968bf1b4f899_JaffaCakes118.dll,#1
  2⤵
  PID:3020

memory/3020-1-0x0000000010000000-0x000000001009C000-memory.dmp

Filesize
624KB

Download
memory/3020-0-0x0000000010000000-0x000000001009C000-memory.dmp

Filesize
624KB

Download