6cd8e62f551f61e738ad05bbb4b904f59d872424c2eca2479ef58516afd043b3

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 13:17

Target

3a4d9e60da682e23e97c3b4db3cab4e7_JaffaCakes118.dll
Size

67KB
MD5

3a4d9e60da682e23e97c3b4db3cab4e7
SHA1

857cc2fb8b33773472c11720f87e7ccfd1a18d9a
SHA256

6cd8e62f551f61e738ad05bbb4b904f59d872424c2eca2479ef58516afd043b3
SHA512

29c4f94f1600dee4e778f347de1eff2d03f9f40c35178a8c0a2c01f7bd1536f7abd6ba06226347736d42dee3c3d0aaf37c4f93b682fcac7e6cd790399b53519c
SSDEEP

1536:J8DXLNunSKCSMQCmBYn5JiHuAuW8ImUcXtD1HiUs1xRWUdQpW:J8TEnSyjCmBYuuNaMwRWUdN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2200	2360	rundll32.exe	28
PID 2360 wrote to memory of 2200	2360	rundll32.exe	28
PID 2360 wrote to memory of 2200	2360	rundll32.exe	28
PID 2360 wrote to memory of 2200	2360	rundll32.exe	28
PID 2360 wrote to memory of 2200	2360	rundll32.exe	28
PID 2360 wrote to memory of 2200	2360	rundll32.exe	28
PID 2360 wrote to memory of 2200	2360	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a4d9e60da682e23e97c3b4db3cab4e7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a4d9e60da682e23e97c3b4db3cab4e7_JaffaCakes118.dll,#1
  2⤵
  PID:2200

memory/2200-1-0x0000000000170000-0x00000000001B1000-memory.dmp

Filesize
260KB

Download
memory/2200-3-0x00000000001AE000-0x00000000001AF000-memory.dmp

Filesize
4KB

Download
memory/2200-2-0x0000000000170000-0x00000000001B1000-memory.dmp

Filesize
260KB

Download
memory/2200-0-0x0000000000170000-0x00000000001B1000-memory.dmp

Filesize
260KB

Download
memory/2200-4-0x0000000000170000-0x0000000000172000-memory.dmp

Filesize
8KB

Download