9379680ef0456d0330aefbebd346c290b2157b7522da078ad7535152eb0fbf54

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 17:03

Target

2d20fca38a28552792d0973ed9a4b4d6_JaffaCakes118.dll
Size

104KB
MD5

2d20fca38a28552792d0973ed9a4b4d6
SHA1

b717979b2e97b339075267a09eb1bf82d6027d8e
SHA256

9379680ef0456d0330aefbebd346c290b2157b7522da078ad7535152eb0fbf54
SHA512

0b035bdce068faa045ee3ae1be893fc1c8f6dbb5efdd43e75f49bb86c0e05c90b5136d0d7a6d006dd6bbd7bc69f123835775cf08398d4cbdd0944f5ce4629328
SSDEEP

3072:m0R0kOUVd2cixJ/aMFA/7rl933OninJRkad0M:mY0khb2cixFk/7XHOiXk2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2460	1712	rundll32.exe	31
PID 1712 wrote to memory of 2460	1712	rundll32.exe	31
PID 1712 wrote to memory of 2460	1712	rundll32.exe	31
PID 1712 wrote to memory of 2460	1712	rundll32.exe	31
PID 1712 wrote to memory of 2460	1712	rundll32.exe	31
PID 1712 wrote to memory of 2460	1712	rundll32.exe	31
PID 1712 wrote to memory of 2460	1712	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d20fca38a28552792d0973ed9a4b4d6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d20fca38a28552792d0973ed9a4b4d6_JaffaCakes118.dll,#1
  2⤵
  PID:2460

memory/2460-4-0x0000000000170000-0x000000000017B000-memory.dmp

Filesize
44KB

Download
memory/2460-0-0x0000000000170000-0x000000000017B000-memory.dmp

Filesize
44KB

Download
memory/2460-5-0x000000001000F000-0x0000000010021000-memory.dmp

Filesize
72KB

Download
memory/2460-6-0x0000000000170000-0x000000000017B000-memory.dmp

Filesize
44KB

Download