5a34fb2ba14ea4166f04e8511acade1ef50475d7e1926b856a6329120ade86bb

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 22:14

Target

619b66d657aca61da127572bd1eb840e_JaffaCakes118.dll
Size

47KB
MD5

619b66d657aca61da127572bd1eb840e
SHA1

e8b0d2fcd577d40214186dcb7a1036685e26bd4b
SHA256

5a34fb2ba14ea4166f04e8511acade1ef50475d7e1926b856a6329120ade86bb
SHA512

911aa8609866f00ca89a7fe5334e918eea5e8e9839c484ac1518872df978dadade96c9734ad3670c23968289538cd16c617f1a9b3b54e324f8870a1cc0c74070
SSDEEP

768:/um3QOB2zRkEV0qApVNV0gTrzs5ZMJvg2SmWmRo65vkeZTH+0xwPbV0GPD58Vf4m:mPO6KEVbsVP0gHzuuvQmRxvVFHfwjuGi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 824	1820	rundll32.exe	28
PID 1820 wrote to memory of 824	1820	rundll32.exe	28
PID 1820 wrote to memory of 824	1820	rundll32.exe	28
PID 1820 wrote to memory of 824	1820	rundll32.exe	28
PID 1820 wrote to memory of 824	1820	rundll32.exe	28
PID 1820 wrote to memory of 824	1820	rundll32.exe	28
PID 1820 wrote to memory of 824	1820	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\619b66d657aca61da127572bd1eb840e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\619b66d657aca61da127572bd1eb840e_JaffaCakes118.dll,#1
  2⤵
  PID:824

memory/824-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/824-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download