2a91ef7baa1d4c6bc12145849e7b7baba0a4f15b932c9a6651d86e907e967e8f

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 23:32

Target

653f1b374f241c3ebdebd6ab0c8238be_JaffaCakes118.dll
Size

86KB
MD5

653f1b374f241c3ebdebd6ab0c8238be
SHA1

0a66ee3d7ebbae291d167f1c227d3cc3a5b1773a
SHA256

2a91ef7baa1d4c6bc12145849e7b7baba0a4f15b932c9a6651d86e907e967e8f
SHA512

520613c4e85dbf0a1872e02f3d11172417b88499f1fce3a0e2b0b99d403748ef8f1ec9e33399d6fbb8c406772032e36a12fb68332d2bf3c3ef3fa5627fe84889
SSDEEP

1536:KLkegizpNp9VYdofQ2oDQwRTq8i6jMRuW1Ad5YDZqkQ2vJ983:KL7gizpNp9VIoo2oDJRTqZZRuDkZ1v3k

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2452	3056	rundll32.exe	30
PID 3056 wrote to memory of 2452	3056	rundll32.exe	30
PID 3056 wrote to memory of 2452	3056	rundll32.exe	30
PID 3056 wrote to memory of 2452	3056	rundll32.exe	30
PID 3056 wrote to memory of 2452	3056	rundll32.exe	30
PID 3056 wrote to memory of 2452	3056	rundll32.exe	30
PID 3056 wrote to memory of 2452	3056	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\653f1b374f241c3ebdebd6ab0c8238be_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\653f1b374f241c3ebdebd6ab0c8238be_JaffaCakes118.dll,#1
  2⤵
  PID:2452

memory/2452-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/2452-1-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download