d5f466a8da68f5e8cd4100d99344c1c6a44916d64f6cc891270f48db61a05ab2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 21:36

Target

3210d110f466a3b31bccf8cc02930d9b_JaffaCakes118.dll
Size

129KB
MD5

3210d110f466a3b31bccf8cc02930d9b
SHA1

a9cc429958dce5484861eabb0a836ee5bf0e9bec
SHA256

d5f466a8da68f5e8cd4100d99344c1c6a44916d64f6cc891270f48db61a05ab2
SHA512

e7b43454466d18d279ea6e40d3b2fb3f4472ee85d2ef52160050e443200a2bd5c0c67a19ce7a9d850a32c132211400b60e7ef5001565a698e5da8445713d4cd7
SSDEEP

3072:BGQBXt7Qqd9CrdQf3SsAViH5FZjH8CMpR7IN5O3:QQBXt7Qqd9UQfPvFZcCiRMN5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2504	2556	rundll32.exe	30
PID 2556 wrote to memory of 2504	2556	rundll32.exe	30
PID 2556 wrote to memory of 2504	2556	rundll32.exe	30
PID 2556 wrote to memory of 2504	2556	rundll32.exe	30
PID 2556 wrote to memory of 2504	2556	rundll32.exe	30
PID 2556 wrote to memory of 2504	2556	rundll32.exe	30
PID 2556 wrote to memory of 2504	2556	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3210d110f466a3b31bccf8cc02930d9b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3210d110f466a3b31bccf8cc02930d9b_JaffaCakes118.dll,#1
  2⤵
  PID:2504

memory/2504-1-0x0000000000410000-0x0000000000450000-memory.dmp

Filesize
256KB

Download
memory/2504-0-0x0000000000410000-0x0000000000450000-memory.dmp

Filesize
256KB

Download