c40f5d59730133f97ca6be149834d054b4857b24d516921baece9e8447ec696f

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 08:57 UTC

Target

6299069f61f81ac5b6a8774c1edae04a_JaffaCakes118.dll
Size

9KB
MD5

6299069f61f81ac5b6a8774c1edae04a
SHA1

5c9385db7bb87bd6839bb280e8d91a7bd670b56e
SHA256

c40f5d59730133f97ca6be149834d054b4857b24d516921baece9e8447ec696f
SHA512

7094a54be1c8990404cbdef9c38da917755a8c40c3da8326965ff99886fa33ade9d54f8400d40a4d974cc25bff43fc672f6a46f156b65fc67c864552744766cd
SSDEEP

96:q1V7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG34b:kuwEt8rsTUtPLzKNWSYWF4b

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 3056	2552	rundll32.exe	31
PID 2552 wrote to memory of 3056	2552	rundll32.exe	31
PID 2552 wrote to memory of 3056	2552	rundll32.exe	31
PID 2552 wrote to memory of 3056	2552	rundll32.exe	31
PID 2552 wrote to memory of 3056	2552	rundll32.exe	31
PID 2552 wrote to memory of 3056	2552	rundll32.exe	31
PID 2552 wrote to memory of 3056	2552	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6299069f61f81ac5b6a8774c1edae04a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6299069f61f81ac5b6a8774c1edae04a_JaffaCakes118.dll,#1
  2⤵
  PID:3056

memory/3056-3-0x0000000000150000-0x0000000000157000-memory.dmp

Filesize
28KB

Download
memory/3056-2-0x0000000000140000-0x0000000000147000-memory.dmp

Filesize
28KB

Download
memory/3056-1-0x0000000000140000-0x0000000000147000-memory.dmp

Filesize
28KB

Download
memory/3056-0-0x0000000000140000-0x0000000000147000-memory.dmp

Filesize
28KB

Download