8a50c74fb971b3e0f5c60cc9953dd8d2a76ad7debc5112d8d28ffb85c6780c47

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 06:20

Target

66752513adc36525ad4651b74dbecbb1_JaffaCakes118.dll
Size

48KB
MD5

66752513adc36525ad4651b74dbecbb1
SHA1

5591e5c555594d60f5734c5b2ef4bee5baae090f
SHA256

8a50c74fb971b3e0f5c60cc9953dd8d2a76ad7debc5112d8d28ffb85c6780c47
SHA512

1b23eded46da03333b4595e60aec23fa83f637b20092b7e2a86511947f3ca99ef491b1067120e38cb37c7a7049c4384dcd9108981eed664d67fc41d5ad0ba6e6
SSDEEP

768:vL/OKs9p/U77Z8uBpvaYXYGFwWlB5tjDyDwqyvIzXo9rY:zm1/U7221aYXYHk5heYQbo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1936	1628	rundll32.exe	28
PID 1628 wrote to memory of 1936	1628	rundll32.exe	28
PID 1628 wrote to memory of 1936	1628	rundll32.exe	28
PID 1628 wrote to memory of 1936	1628	rundll32.exe	28
PID 1628 wrote to memory of 1936	1628	rundll32.exe	28
PID 1628 wrote to memory of 1936	1628	rundll32.exe	28
PID 1628 wrote to memory of 1936	1628	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66752513adc36525ad4651b74dbecbb1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66752513adc36525ad4651b74dbecbb1_JaffaCakes118.dll,#1
  2⤵
  PID:1936

memory/1936-1-0x0000000000900000-0x00000000009D6000-memory.dmp

Filesize
856KB

Download
memory/1936-0-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1936-2-0x0000000000900000-0x00000000009D6000-memory.dmp

Filesize
856KB

Download