99b5785fd3b9f6ca51a2742857badee1579a57410f83a3ed0c62c10a47787a73

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 15:02

Target

30dbaa987fc03453f2e97afebc850672_JaffaCakes118.dll
Size

56KB
MD5

30dbaa987fc03453f2e97afebc850672
SHA1

d0c35c4245617b1c922d006c7c222cdb727413d6
SHA256

99b5785fd3b9f6ca51a2742857badee1579a57410f83a3ed0c62c10a47787a73
SHA512

ab16fed433213e6cc0e7ad155911a6d3c2e5ea4a3b8438e8c230049404350f9507dd0b6580e6b36cefda8c52af26ec4f8098015344f2002533c4e87e1d99fff6
SSDEEP

768:gX2uZzEo8fwr+vycHQwhD28jyrAwo9w1dehtSrcmv6eVA9ABrpHDE:62uRE5f8+vptd28erok3LA9ABlHD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2504	2556	rundll32.exe	30
PID 2556 wrote to memory of 2504	2556	rundll32.exe	30
PID 2556 wrote to memory of 2504	2556	rundll32.exe	30
PID 2556 wrote to memory of 2504	2556	rundll32.exe	30
PID 2556 wrote to memory of 2504	2556	rundll32.exe	30
PID 2556 wrote to memory of 2504	2556	rundll32.exe	30
PID 2556 wrote to memory of 2504	2556	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\30dbaa987fc03453f2e97afebc850672_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\30dbaa987fc03453f2e97afebc850672_JaffaCakes118.dll,#1
  2⤵
  PID:2504

memory/2504-0-0x0000000010002000-0x0000000010003000-memory.dmp

Filesize
4KB

Download
memory/2504-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download