ed1e1e97ccaf598c5aa11c0b58aa78e1887b8199efd3251116573ee270472586

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 18:07

Target

60e0c76dab80076d75d19a839aa5d840_JaffaCakes118.dll
Size

61KB
MD5

60e0c76dab80076d75d19a839aa5d840
SHA1

d4ffcca7cb2f886d9dc8729c9e6ae6e41f329bc0
SHA256

ed1e1e97ccaf598c5aa11c0b58aa78e1887b8199efd3251116573ee270472586
SHA512

8103a0cbd7341e1a4f84aad5b34767af14ebd9c9ab6e9ca5280443eca7d30c3e3ac8cd75638d8de427490ca53dd1268b8a7fd7c94b0f1fc6dc9b10cc5d556aeb
SSDEEP

768:VBhe4tujjKsBQfMKlYBOEWNBJrMZ7wADrlL1Va4AVdyjACKwbs2j+t:siax4CBhAMZ7B44e2Lj+t

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2512	2116	rundll32.exe	30
PID 2116 wrote to memory of 2512	2116	rundll32.exe	30
PID 2116 wrote to memory of 2512	2116	rundll32.exe	30
PID 2116 wrote to memory of 2512	2116	rundll32.exe	30
PID 2116 wrote to memory of 2512	2116	rundll32.exe	30
PID 2116 wrote to memory of 2512	2116	rundll32.exe	30
PID 2116 wrote to memory of 2512	2116	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60e0c76dab80076d75d19a839aa5d840_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60e0c76dab80076d75d19a839aa5d840_JaffaCakes118.dll,#1
  2⤵
  PID:2512

memory/2512-0-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2512-1-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download