3c81814eb6ae05e1f6634c0b7bf26f95f52dad446e1de718facf97bfa86ab767

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 22:45

Target

2681d2147471b88479d58f6c79066f16_JaffaCakes118.dll
Size

65KB
MD5

2681d2147471b88479d58f6c79066f16
SHA1

3bdd0c2d28418890eca2b4ca2394ac325e6b4b9e
SHA256

3c81814eb6ae05e1f6634c0b7bf26f95f52dad446e1de718facf97bfa86ab767
SHA512

a5bf98841bde36d216ebc5e28a016526093abe0860f267059948d592c3093c14aaafe714990dbd8c4f5a5959a3ffce3e40ddfa0d619a395fc1d4b39d6dd08b15
SSDEEP

1536:XyDcClW8TNg8TtbmIuZCcUyuhq1okCM2O8j7M8H/UAW3j+wekn:CgppAt5uZCcL4qg74oySwekn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1744 wrote to memory of 2032	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 2032	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 2032	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 2032	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 2032	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 2032	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 2032	1744	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2681d2147471b88479d58f6c79066f16_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2681d2147471b88479d58f6c79066f16_JaffaCakes118.dll,#1
2⤵
PID:2032

memory/2032-2-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2032-1-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2032-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2032-5-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2032-4-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2032-3-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2032-6-0x000000001001E000-0x000000001001F000-memory.dmp

Filesize
4KB

Download
memory/2032-10-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2032-9-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2032-8-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2032-7-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download