d9b61f355c48acf84803afe892a0b0bd17d44c3976e9dd68f91eb1fa8176f280

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 03:40

Target

2edef7d213a429c7b48b6aec7076951c_JaffaCakes118.dll
Size

86KB
MD5

2edef7d213a429c7b48b6aec7076951c
SHA1

61788c9d1315ced32807076101fb98ed63bd8f07
SHA256

d9b61f355c48acf84803afe892a0b0bd17d44c3976e9dd68f91eb1fa8176f280
SHA512

4c13ebea2835249788f1aecee657bcdba3d514e8e2dbd8ed3c6ec6d4787a171fe11604dac28ff23b8e22680a747143914152058b6fcc976819af62a13edac5f6
SSDEEP

1536:bq+dX5z9lhsRbarmsapZyWK+0IStWJ+xruajIDUsL+JjiHq0VaO1FsPRFDmu+T+:bbdRhsRwmsmB4tCailUsLHq0VaODQp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2140	2992	rundll32.exe	30
PID 2992 wrote to memory of 2140	2992	rundll32.exe	30
PID 2992 wrote to memory of 2140	2992	rundll32.exe	30
PID 2992 wrote to memory of 2140	2992	rundll32.exe	30
PID 2992 wrote to memory of 2140	2992	rundll32.exe	30
PID 2992 wrote to memory of 2140	2992	rundll32.exe	30
PID 2992 wrote to memory of 2140	2992	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2edef7d213a429c7b48b6aec7076951c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2edef7d213a429c7b48b6aec7076951c_JaffaCakes118.dll,#1
  2⤵
  PID:2140

memory/2140-1-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/2140-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/2140-2-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download