814076f73eb1c4e1a97586f243835063421cbad9d7a1a71df00fb7898c5e7adb

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 22:04

Target

2df9ef831acf33c0dd7d864846ab062c_JaffaCakes118.dll
Size

329KB
MD5

2df9ef831acf33c0dd7d864846ab062c
SHA1

06f6cbbf6a6cd4e17391dc7672e91432eb485ef4
SHA256

814076f73eb1c4e1a97586f243835063421cbad9d7a1a71df00fb7898c5e7adb
SHA512

e8b4bb66790fb10d5385543e8e9fa6114734b0aae9441e3eb8d41a38a3298f56761fe7a2be70f464e4d5079ba7d37f45918896c9632415d56581a031d053c548
SSDEEP

6144:IPLfPatz0fiqhHNknDK68JuMdw5yLSeOSD2h+kTjh3EQJpv:Oatz0bhH4K688RQLqT+kpU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2696	2332	rundll32.exe	30
PID 2332 wrote to memory of 2696	2332	rundll32.exe	30
PID 2332 wrote to memory of 2696	2332	rundll32.exe	30
PID 2332 wrote to memory of 2696	2332	rundll32.exe	30
PID 2332 wrote to memory of 2696	2332	rundll32.exe	30
PID 2332 wrote to memory of 2696	2332	rundll32.exe	30
PID 2332 wrote to memory of 2696	2332	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2df9ef831acf33c0dd7d864846ab062c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2df9ef831acf33c0dd7d864846ab062c_JaffaCakes118.dll,#1
  2⤵
  PID:2696

memory/2696-0-0x0000000010000000-0x00000000100DC000-memory.dmp

Filesize
880KB

Download