6f899fecc0527766249afa70d13160b4c807645fd99f337bb89918771af06c46

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 01:19

Target

6594683c05b7ac775d9d1b054031e910_JaffaCakes118.dll
Size

65KB
MD5

6594683c05b7ac775d9d1b054031e910
SHA1

3eeb2b2d114cdd4bebc1431c97aded886ff6f681
SHA256

6f899fecc0527766249afa70d13160b4c807645fd99f337bb89918771af06c46
SHA512

2fe507ff44050b298d856a7cc9d70f0b45abf136b8a4ab8e78dcacc7f4408c20509d316cd29a866ab6d5bc84be2ce1522ade9e8d0efe794dacc6db79be420c3c
SSDEEP

1536:AOjdIl3/IjJ2o0VObKR8Q5Po2HrYWkjGizi8f8GjrhcT:vI1gNF0RMi68Gnha

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1660	2380	rundll32.exe	30
PID 2380 wrote to memory of 1660	2380	rundll32.exe	30
PID 2380 wrote to memory of 1660	2380	rundll32.exe	30
PID 2380 wrote to memory of 1660	2380	rundll32.exe	30
PID 2380 wrote to memory of 1660	2380	rundll32.exe	30
PID 2380 wrote to memory of 1660	2380	rundll32.exe	30
PID 2380 wrote to memory of 1660	2380	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6594683c05b7ac775d9d1b054031e910_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6594683c05b7ac775d9d1b054031e910_JaffaCakes118.dll,#1
  2⤵
  PID:1660

memory/1660-3-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1660-2-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1660-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1660-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download