8aad4a03f98d44fe7baf4ad2861a97c25c24d4c949302b98de2c9aedce18e755

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 10:52

Target

62f274a1b070e23032185aa98bcfdce5_JaffaCakes118.dll
Size

123KB
MD5

62f274a1b070e23032185aa98bcfdce5
SHA1

78acae2fc40d3b0213bd84d111643d616783306f
SHA256

8aad4a03f98d44fe7baf4ad2861a97c25c24d4c949302b98de2c9aedce18e755
SHA512

b7de20fb971609079dcb3f669d590f503a67415f8c2d7d54c7bee30162af6fec8e10ba8628ecc90fddee3e6a292fd504b2ae22a81782eefdc983f608403076b8
SSDEEP

3072:YAUYWPxfm+k8Q5BlscTNC356W8YgXesYKiVFMTtXE7W:nUYWNmBVKx35mXesi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2396	2568	rundll32.exe	30
PID 2568 wrote to memory of 2396	2568	rundll32.exe	30
PID 2568 wrote to memory of 2396	2568	rundll32.exe	30
PID 2568 wrote to memory of 2396	2568	rundll32.exe	30
PID 2568 wrote to memory of 2396	2568	rundll32.exe	30
PID 2568 wrote to memory of 2396	2568	rundll32.exe	30
PID 2568 wrote to memory of 2396	2568	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\62f274a1b070e23032185aa98bcfdce5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\62f274a1b070e23032185aa98bcfdce5_JaffaCakes118.dll,#1
  2⤵
  PID:2396

memory/2396-0-0x0000000000240000-0x0000000000279000-memory.dmp

Filesize
228KB

Download
memory/2396-2-0x0000000000276000-0x0000000000277000-memory.dmp

Filesize
4KB

Download
memory/2396-1-0x0000000000240000-0x0000000000279000-memory.dmp

Filesize
228KB

Download