1880f1f145827f481ea42abd761243555f2e49e53d513d3ec14bd1f10eb69019

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 01:20

Target

659586125da41c24c158ad584dd96a4b_JaffaCakes118.dll
Size

129KB
MD5

659586125da41c24c158ad584dd96a4b
SHA1

11babbd9dd39379af0a4c1b719e4951766453539
SHA256

1880f1f145827f481ea42abd761243555f2e49e53d513d3ec14bd1f10eb69019
SHA512

2936c5cb9f140400f68e9461cc571473b2cf775e761bfb57b6d7351aeb6bb38abd34d4cbd69a7850b68fb74c031b68049bcecc2ce98ee89102fc51e6eda05027
SSDEEP

3072:7PnCuXUkETUOtVIqzzwIeOozRxOk/2l0ruqofq7aqVHK:DCuXErXjHiRP+QofDq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2092	1856	rundll32.exe	30
PID 1856 wrote to memory of 2092	1856	rundll32.exe	30
PID 1856 wrote to memory of 2092	1856	rundll32.exe	30
PID 1856 wrote to memory of 2092	1856	rundll32.exe	30
PID 1856 wrote to memory of 2092	1856	rundll32.exe	30
PID 1856 wrote to memory of 2092	1856	rundll32.exe	30
PID 1856 wrote to memory of 2092	1856	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\659586125da41c24c158ad584dd96a4b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\659586125da41c24c158ad584dd96a4b_JaffaCakes118.dll,#1
  2⤵
  PID:2092

memory/2092-1-0x00000000020B0000-0x00000000020F0000-memory.dmp

Filesize
256KB

Download
memory/2092-0-0x00000000020B0000-0x00000000020F0000-memory.dmp

Filesize
256KB

Download