158eaa4989f3b78f9d103c53625507628af008572946cb2a384c96a123dbe079

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 09:17

Target

62a902225f8a4080de02141f041658ff_JaffaCakes118.dll
Size

84KB
MD5

62a902225f8a4080de02141f041658ff
SHA1

6dc918eece121621b0cbf9d10f6abb34703c26d5
SHA256

158eaa4989f3b78f9d103c53625507628af008572946cb2a384c96a123dbe079
SHA512

64dd410146d97c7a38b6d7a632a9539bf93c21fd7394d1d4008c7f6413e97a2fb98a892a1ec039f349a283dabd46f089aefe06517b6d996db06779d5f43ecaaf
SSDEEP

1536:6FzN559FOWtdbRTA2lsi0d1eplzxDah4PNieZwu+v23SIlEn5fNsuneSoaTl:ozPjbRT1+xAftAsH+okxOOAaTl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2976	2968	rundll32.exe	30
PID 2968 wrote to memory of 2976	2968	rundll32.exe	30
PID 2968 wrote to memory of 2976	2968	rundll32.exe	30
PID 2968 wrote to memory of 2976	2968	rundll32.exe	30
PID 2968 wrote to memory of 2976	2968	rundll32.exe	30
PID 2968 wrote to memory of 2976	2968	rundll32.exe	30
PID 2968 wrote to memory of 2976	2968	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\62a902225f8a4080de02141f041658ff_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\62a902225f8a4080de02141f041658ff_JaffaCakes118.dll,#1
  2⤵
  PID:2976

memory/2976-3-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2976-2-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2976-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2976-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download