3c6e43420568bf05563b838d3949716765c4a634e5224f7af578566f9fd57922

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 09:57

Target

2fea58128a893b1a5119f30ab648de86_JaffaCakes118.dll
Size

22KB
MD5

2fea58128a893b1a5119f30ab648de86
SHA1

e2172309f228d6af58eac3c5f26404f82afc7899
SHA256

3c6e43420568bf05563b838d3949716765c4a634e5224f7af578566f9fd57922
SHA512

46ad2c599af22ec940765cd6efa28f210b83751253264f8ddc32d1dfec1c40eb30964bc339896ecd13aa986b082036c041e97fbadd2afd4a29589aaed3cf226c
SSDEEP

384:LWWTEcWlypHksHzgHIhL9x7kHpBqZlb+W+poqbHj/ZWD/9qLKP3j+JSd6oGswCn:kuHksEHnBElbt7GHD4z9q2Ld4s9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2232	2104	rundll32.exe	30
PID 2104 wrote to memory of 2232	2104	rundll32.exe	30
PID 2104 wrote to memory of 2232	2104	rundll32.exe	30
PID 2104 wrote to memory of 2232	2104	rundll32.exe	30
PID 2104 wrote to memory of 2232	2104	rundll32.exe	30
PID 2104 wrote to memory of 2232	2104	rundll32.exe	30
PID 2104 wrote to memory of 2232	2104	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fea58128a893b1a5119f30ab648de86_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fea58128a893b1a5119f30ab648de86_JaffaCakes118.dll,#1
  2⤵
  PID:2232

memory/2232-4-0x000000000021C000-0x000000000021D000-memory.dmp

Filesize
4KB

Download
memory/2232-3-0x0000000000200000-0x0000000000224000-memory.dmp

Filesize
144KB

Download
memory/2232-2-0x00000000001F0000-0x0000000000214000-memory.dmp

Filesize
144KB

Download
memory/2232-1-0x00000000001F0000-0x0000000000214000-memory.dmp

Filesize
144KB

Download
memory/2232-0-0x00000000001F0000-0x0000000000214000-memory.dmp

Filesize
144KB

Download