e05727587cc6bc051c350959894a722fdbae0646729a24173a8715e778ef469f

Analysis

max time kernel
30s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 10:33

Target

30075631c01bee8491a4431e1943d937_JaffaCakes118.dll
Size

184KB
MD5

30075631c01bee8491a4431e1943d937
SHA1

3687f0db777703faab260ea11fa348f649ffa152
SHA256

e05727587cc6bc051c350959894a722fdbae0646729a24173a8715e778ef469f
SHA512

3df765f9da23fc785c84e8f6c56e8b49d51a0e38539ebc3652c23e84ea4eb50ae320b0016c4313dd6f29715f6c17177470fb92f4bf1e62db37738c679a903348
SSDEEP

3072:j1RgQh30b3wChjak59YgDJZyUkyve1FgC8lAi4220RCcguBD7r/2/tNQQqNtKhN:j1RgQCh3DJZfkuePg8iv25cZB7jQ+Kh

Score

1^/10

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1760	1972	rundll32.exe	29
PID 1972 wrote to memory of 1760	1972	rundll32.exe	29
PID 1972 wrote to memory of 1760	1972	rundll32.exe	29
PID 1972 wrote to memory of 1760	1972	rundll32.exe	29
PID 1972 wrote to memory of 1760	1972	rundll32.exe	29
PID 1972 wrote to memory of 1760	1972	rundll32.exe	29
PID 1972 wrote to memory of 1760	1972	rundll32.exe	29
PID 1760 wrote to memory of 2700	1760	rundll32.exe	30
PID 1760 wrote to memory of 2700	1760	rundll32.exe	30
PID 1760 wrote to memory of 2700	1760	rundll32.exe	30
PID 1760 wrote to memory of 2700	1760	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\30075631c01bee8491a4431e1943d937_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\30075631c01bee8491a4431e1943d937_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:2700

memory/1760-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1760-0-0x0000000000428000-0x000000000042C000-memory.dmp

Filesize
16KB

Download
memory/1760-2-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1760-3-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1760-4-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1760-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download