a399e2fe4271e88fc0d3a7504934c63c9a73e223a2fdc34d3dd3c0e75118f72c

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 18:55

Target

64636291c45ff0d34cb5ad018988b583_JaffaCakes118.dll
Size

94KB
MD5

64636291c45ff0d34cb5ad018988b583
SHA1

d0cc5f5a4878dc3882ec54d61ecebf1bf79772cc
SHA256

a399e2fe4271e88fc0d3a7504934c63c9a73e223a2fdc34d3dd3c0e75118f72c
SHA512

b89bc46b39d90d3e709c793266ee1a0bf5066681b881b6b6cda81c554aa34aee767f18abca0e752d653848fac56b3f4081a6ec2022a3a524dd9ab574dfb179f2
SSDEEP

1536:RtbgxApSCTx3fu9TLxmvDybnAO76VM6MPxmDLAyexEjqM2HOCt1j6t7CPjEQbs0E:RNgoSCNvuxcv21hMPnexEu1jt1s7OI0c

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2188	1688	rundll32.exe	30
PID 1688 wrote to memory of 2188	1688	rundll32.exe	30
PID 1688 wrote to memory of 2188	1688	rundll32.exe	30
PID 1688 wrote to memory of 2188	1688	rundll32.exe	30
PID 1688 wrote to memory of 2188	1688	rundll32.exe	30
PID 1688 wrote to memory of 2188	1688	rundll32.exe	30
PID 1688 wrote to memory of 2188	1688	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64636291c45ff0d34cb5ad018988b583_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64636291c45ff0d34cb5ad018988b583_JaffaCakes118.dll,#1
  2⤵
  PID:2188

memory/2188-1-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/2188-3-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/2188-2-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/2188-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download