5659b0d202eee21c1f95e9ed74c0a6362b04796849c07e3c07c260002851119c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 22:12

Target

64fed06390a8a4ec2d87f06b30efae05_JaffaCakes118.dll
Size

1.1MB
MD5

64fed06390a8a4ec2d87f06b30efae05
SHA1

6a13bb6b5098b75520047bfae661f72b667e409a
SHA256

5659b0d202eee21c1f95e9ed74c0a6362b04796849c07e3c07c260002851119c
SHA512

923c764ed3da031b6a953f13f06838e98ae3d374b68d332ad69deb4de2819d8ef09a55b3508b551932b9c81b484e8380b70f7887abe4687ebb537fef9a546542
SSDEEP

24576:YNwY9kjEHdtqg8kCO3mkzRs++20WNEdkpBUHpb:YNB6jMdtbPeN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2712	2704	rundll32.exe	31
PID 2704 wrote to memory of 2712	2704	rundll32.exe	31
PID 2704 wrote to memory of 2712	2704	rundll32.exe	31
PID 2704 wrote to memory of 2712	2704	rundll32.exe	31
PID 2704 wrote to memory of 2712	2704	rundll32.exe	31
PID 2704 wrote to memory of 2712	2704	rundll32.exe	31
PID 2704 wrote to memory of 2712	2704	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64fed06390a8a4ec2d87f06b30efae05_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64fed06390a8a4ec2d87f06b30efae05_JaffaCakes118.dll,#1
  2⤵
  PID:2712

memory/2712-0-0x000000006DD30000-0x000000006DE59000-memory.dmp

Filesize
1.2MB

Download
memory/2712-1-0x000000006DD30000-0x000000006DE59000-memory.dmp

Filesize
1.2MB

Download
memory/2712-2-0x000000006DD30000-0x000000006DE59000-memory.dmp

Filesize
1.2MB

Download
memory/2712-4-0x000000006DD30000-0x000000006DE59000-memory.dmp

Filesize
1.2MB

Download
memory/2712-3-0x000000006DD30000-0x000000006DE59000-memory.dmp

Filesize
1.2MB

Download