d8f8557a1d7d27b73269caacd0ccefd8cd24c5dfa27761a63fee558a9a8d272f

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 00:05

Target

3289c514ea8a86d69a84a309c82c063b_JaffaCakes118.dll
Size

28KB
MD5

3289c514ea8a86d69a84a309c82c063b
SHA1

1d46c0a74610967936ad373c3614eec6999414ee
SHA256

d8f8557a1d7d27b73269caacd0ccefd8cd24c5dfa27761a63fee558a9a8d272f
SHA512

ee1075f561ec689d6af89f42b9da5c7df84557e470f6f395ed5ad3f535fab8ef90d0cfa82e276f0a4a5be614d4f530bc8cdcd9bfd1461a1111d6819107d57052
SSDEEP

768:GkBtBgRQ4Fu4PEDu9BycRo4VmFJC9mThVcDl+xtKf61BywcG:GkOki9BdRVkGK3cD2t8wcG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2176	1628	rundll32.exe	30
PID 1628 wrote to memory of 2176	1628	rundll32.exe	30
PID 1628 wrote to memory of 2176	1628	rundll32.exe	30
PID 1628 wrote to memory of 2176	1628	rundll32.exe	30
PID 1628 wrote to memory of 2176	1628	rundll32.exe	30
PID 1628 wrote to memory of 2176	1628	rundll32.exe	30
PID 1628 wrote to memory of 2176	1628	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3289c514ea8a86d69a84a309c82c063b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3289c514ea8a86d69a84a309c82c063b_JaffaCakes118.dll,#1
  2⤵
  PID:2176

memory/2176-1-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2176-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2176-3-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2176-2-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download