7d0dcc8b1ccf6edb965fbce969731daf326b244564f431b87435aa2de0e5f05b

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 03:43

Target

332c7ba264c164cc0e3f5072e5613540_JaffaCakes118.dll
Size

305KB
MD5

332c7ba264c164cc0e3f5072e5613540
SHA1

e98991d41e4b6f8b1222841aec7ed8e263594e7b
SHA256

7d0dcc8b1ccf6edb965fbce969731daf326b244564f431b87435aa2de0e5f05b
SHA512

d624e6d81428497d91fa47448ba5a15072db7c43bcdbf6b2f3ed53a267a2727a163179373af46adf21bb7b3cd105cf59c6c9ba981a4ad0684ecbac0e8dd9c363
SSDEEP

6144:NDBh7B0pHTah4lz2CZ9v+Zbj4F81U2e97Zq9FprzLIqKjs9QG:8uqlaa2ZA8de9FkDIqmG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2780	2732	rundll32.exe	30
PID 2732 wrote to memory of 2780	2732	rundll32.exe	30
PID 2732 wrote to memory of 2780	2732	rundll32.exe	30
PID 2732 wrote to memory of 2780	2732	rundll32.exe	30
PID 2732 wrote to memory of 2780	2732	rundll32.exe	30
PID 2732 wrote to memory of 2780	2732	rundll32.exe	30
PID 2732 wrote to memory of 2780	2732	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\332c7ba264c164cc0e3f5072e5613540_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\332c7ba264c164cc0e3f5072e5613540_JaffaCakes118.dll,#1
  2⤵
  PID:2780

memory/2780-1-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download
memory/2780-0-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download