d9deea4fd4d946df73eaf3792633432fb6ceb8b73364580b00681c95aa0c2590

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 04:22

Target

21105ed415dfd65be6a21a68afc312d1_JaffaCakes118.dll
Size

274KB
MD5

21105ed415dfd65be6a21a68afc312d1
SHA1

924bbb44b32d3d409c4f739b6911b87fca296571
SHA256

d9deea4fd4d946df73eaf3792633432fb6ceb8b73364580b00681c95aa0c2590
SHA512

a7ade43ec46cb80bc2a2f2446e4c0f94b634027e69f8964ac43726079c3de649062a8100833a3afab836860d86cac9c7295a0876068d2f015b18a28aed3ffc55
SSDEEP

6144:IOSjIXo9jPDv5eisvDs8W7s9ZuJrUO//oOqzTzlUK/zNFe5kQn:3549zDUis7s8W7GYAOqWAMiQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2896	2860	rundll32.exe	28
PID 2860 wrote to memory of 2896	2860	rundll32.exe	28
PID 2860 wrote to memory of 2896	2860	rundll32.exe	28
PID 2860 wrote to memory of 2896	2860	rundll32.exe	28
PID 2860 wrote to memory of 2896	2860	rundll32.exe	28
PID 2860 wrote to memory of 2896	2860	rundll32.exe	28
PID 2860 wrote to memory of 2896	2860	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21105ed415dfd65be6a21a68afc312d1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21105ed415dfd65be6a21a68afc312d1_JaffaCakes118.dll,#1
  2⤵
  PID:2896

memory/2896-1-0x00000000736D0000-0x000000007371C000-memory.dmp

Filesize
304KB

Download
memory/2896-2-0x00000000736D0000-0x000000007371C000-memory.dmp

Filesize
304KB

Download
memory/2896-0-0x00000000736D0000-0x000000007371C000-memory.dmp

Filesize
304KB

Download