00de4cab65c6198fe77190448836642a2354a8ab08b5be1c2506b0cb8d6fdb02

Analysis

max time kernel
11s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 19:51

Target

2d9c2eb8433d0551fb57bbc04a41ab33_JaffaCakes118.dll
Size

9KB
MD5

2d9c2eb8433d0551fb57bbc04a41ab33
SHA1

77fdf736531bd96f8b036f0537519e5da19bb71d
SHA256

00de4cab65c6198fe77190448836642a2354a8ab08b5be1c2506b0cb8d6fdb02
SHA512

fdd0f24e24505758fa81ad8129610984d494c80cbc5633ccee3cceb4883cb1ab0fafcc6bce80250f5f6c8b1e42d01868cc8a792b584f9740ab6e96751a7db658
SSDEEP

96:q1V7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG34b:kuwEt8rsTUtPLzKNWSYWF4b

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2736	2992	rundll32.exe	29
PID 2992 wrote to memory of 2736	2992	rundll32.exe	29
PID 2992 wrote to memory of 2736	2992	rundll32.exe	29
PID 2992 wrote to memory of 2736	2992	rundll32.exe	29
PID 2992 wrote to memory of 2736	2992	rundll32.exe	29
PID 2992 wrote to memory of 2736	2992	rundll32.exe	29
PID 2992 wrote to memory of 2736	2992	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d9c2eb8433d0551fb57bbc04a41ab33_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d9c2eb8433d0551fb57bbc04a41ab33_JaffaCakes118.dll,#1
  2⤵
  PID:2736

memory/2736-2-0x00000000001E0000-0x00000000001E7000-memory.dmp

Filesize
28KB

Download
memory/2736-3-0x00000000001F0000-0x00000000001F7000-memory.dmp

Filesize
28KB

Download
memory/2736-0-0x00000000001E0000-0x00000000001E7000-memory.dmp

Filesize
28KB

Download
memory/2736-1-0x00000000001E0000-0x00000000001E7000-memory.dmp

Filesize
28KB

Download