c4b587d143c9f50e103424e3986337340a57af3b2fb8ade415cf1b6c9e1ea52f

Analysis

max time kernel
15s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 16:01

Target

2705258af2bcef091a4db72ae2d3c199_JaffaCakes118.dll
Size

33KB
MD5

2705258af2bcef091a4db72ae2d3c199
SHA1

e996ab9d31ecd17fd098c40d9b768060a2519cac
SHA256

c4b587d143c9f50e103424e3986337340a57af3b2fb8ade415cf1b6c9e1ea52f
SHA512

5d7b518f756c34a7b02eec0c826448793f13bad790e69ec1b2e5ec4e5b889cdc9cfe5306f196067f2f73b48a15b2877fe8ef02fa60b31ed28c17dac4ee829993
SSDEEP

768:MbU4okz7NW1N0PmVB8VBZ4HHhs2Q4Mra0nbcuyD7Uc1A/Y:MbXvNW1CmB8/STMnouy8c1AA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 3052	3008	rundll32.exe	29
PID 3008 wrote to memory of 3052	3008	rundll32.exe	29
PID 3008 wrote to memory of 3052	3008	rundll32.exe	29
PID 3008 wrote to memory of 3052	3008	rundll32.exe	29
PID 3008 wrote to memory of 3052	3008	rundll32.exe	29
PID 3008 wrote to memory of 3052	3008	rundll32.exe	29
PID 3008 wrote to memory of 3052	3008	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2705258af2bcef091a4db72ae2d3c199_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2705258af2bcef091a4db72ae2d3c199_JaffaCakes118.dll,#1
  2⤵
  PID:3052

memory/3052-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3052-3-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3052-2-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3052-1-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download