70663e4beb4826523fc3e093f7d43b25d937b928cdfe52b680de8f7d2b98c5fe

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 18:50

Target

645ec49b95f764235214b188d64ba452_JaffaCakes118.dll
Size

46KB
MD5

645ec49b95f764235214b188d64ba452
SHA1

89363254ce1f2f017ae02dad3d31ecc8972522c8
SHA256

70663e4beb4826523fc3e093f7d43b25d937b928cdfe52b680de8f7d2b98c5fe
SHA512

862d8b3a94c3712df8047eda20eedcb31f24f2aed9e1a61a4d215fc85a2df32e116284258cf61e2cb7a4e2fb2a6cf8192c90407a61a8699ba921acb9c9369344
SSDEEP

768:+hjs2Bb5A9FE2Q4Sy9a9QiA9wZ9gBdrduKku12QdWCyo9v8+:fCqM4lOGTj+toB8+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1652	1612	rundll32.exe	30
PID 1612 wrote to memory of 1652	1612	rundll32.exe	30
PID 1612 wrote to memory of 1652	1612	rundll32.exe	30
PID 1612 wrote to memory of 1652	1612	rundll32.exe	30
PID 1612 wrote to memory of 1652	1612	rundll32.exe	30
PID 1612 wrote to memory of 1652	1612	rundll32.exe	30
PID 1612 wrote to memory of 1652	1612	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\645ec49b95f764235214b188d64ba452_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\645ec49b95f764235214b188d64ba452_JaffaCakes118.dll,#1
  2⤵
  PID:1652

memory/1652-0-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download