1575b38633eca49f7ba3434f37d455723128e2d10031690ecc248342ff16f815

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 22:01

Target

3224322b56d1522190fa346f72f99c35_JaffaCakes118.dll
Size

102KB
MD5

3224322b56d1522190fa346f72f99c35
SHA1

f43e9145bf23761c2711e4b1c8f00e666d0f8f1b
SHA256

1575b38633eca49f7ba3434f37d455723128e2d10031690ecc248342ff16f815
SHA512

051fc2c44300b093028b32c930f5aac4f76ed603e72a27cb419c598aeedcad558aa6355baf43499de3fe7fb7d2f58f6b01dc4bf48fe27843a413448b78a6cb71
SSDEEP

1536:4G31s6OxArk6ytVNWaRUtaW1g0RJidKxtMe37rANdzGXtljvRFk:B3wxV33r+aWG0LidqtMyudiXtxw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2528	2936	rundll32.exe	30
PID 2936 wrote to memory of 2528	2936	rundll32.exe	30
PID 2936 wrote to memory of 2528	2936	rundll32.exe	30
PID 2936 wrote to memory of 2528	2936	rundll32.exe	30
PID 2936 wrote to memory of 2528	2936	rundll32.exe	30
PID 2936 wrote to memory of 2528	2936	rundll32.exe	30
PID 2936 wrote to memory of 2528	2936	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3224322b56d1522190fa346f72f99c35_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3224322b56d1522190fa346f72f99c35_JaffaCakes118.dll,#1
  2⤵
  PID:2528

memory/2528-2-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2528-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2528-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download