46003e915057843be286f037f4758eba40268f0d0d7ca7d2e61f00fdaa878ea7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 09:12

Target

2fc63a7c873acf9c4265bb1a3c74cd40_JaffaCakes118.dll
Size

148KB
MD5

2fc63a7c873acf9c4265bb1a3c74cd40
SHA1

01bd9b05a4c8faefa2eec492ed1cdc7163a2c884
SHA256

46003e915057843be286f037f4758eba40268f0d0d7ca7d2e61f00fdaa878ea7
SHA512

0a1633d424170abd9a454700eb0b9dd45e349c17c2683c6c8aa48c3760b1626c857a73a8c9cc5581a01a4aa4c6bb31887731bc46fa4459ab36a87016185a6e99
SSDEEP

3072:/oYcJULrsdEf4Koilmp6MqqDLy/TF8ms4akxKxTO:hcJcAO4VilmppqqDLuTFLK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1712	2360	rundll32.exe	31
PID 2360 wrote to memory of 1712	2360	rundll32.exe	31
PID 2360 wrote to memory of 1712	2360	rundll32.exe	31
PID 2360 wrote to memory of 1712	2360	rundll32.exe	31
PID 2360 wrote to memory of 1712	2360	rundll32.exe	31
PID 2360 wrote to memory of 1712	2360	rundll32.exe	31
PID 2360 wrote to memory of 1712	2360	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fc63a7c873acf9c4265bb1a3c74cd40_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fc63a7c873acf9c4265bb1a3c74cd40_JaffaCakes118.dll,#1
  2⤵
  PID:1712

memory/1712-5-0x0000000010017000-0x000000001002E000-memory.dmp

Filesize
92KB

Download
memory/1712-4-0x0000000000230000-0x000000000023A000-memory.dmp

Filesize
40KB

Download
memory/1712-6-0x0000000000230000-0x000000000023A000-memory.dmp

Filesize
40KB

Download
memory/1712-0-0x0000000000230000-0x000000000023A000-memory.dmp

Filesize
40KB

Download