4877c95ad294b175dddbbcc1159dfc8a8402081122a181bfcb6414245e7dc8a6

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 06:47

Target

33b8751fc9672edacafae1d8491c0473_JaffaCakes118.dll
Size

49KB
MD5

33b8751fc9672edacafae1d8491c0473
SHA1

2ce6e921bdcb1eb44667f62a3596c7ef31500114
SHA256

4877c95ad294b175dddbbcc1159dfc8a8402081122a181bfcb6414245e7dc8a6
SHA512

06b74b8b7a8bf7f320e92bdc25a62c2d9e142e48619dad9885c9a2810ab5f7b9c5e8b618cbe07b584459d3e59145cefeda9f3c050b7897688e80e46baf1507ad
SSDEEP

768:v+VNXdnvCCKmPpctL0TJ9AmeK+ZK0/b4BvByEWt1TDBE9M5vU9KobkFIVCeI:v+VNNaCKYp1nLJ0KyEsRuMqKXICeI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 3060	2848	rundll32.exe	30
PID 2848 wrote to memory of 3060	2848	rundll32.exe	30
PID 2848 wrote to memory of 3060	2848	rundll32.exe	30
PID 2848 wrote to memory of 3060	2848	rundll32.exe	30
PID 2848 wrote to memory of 3060	2848	rundll32.exe	30
PID 2848 wrote to memory of 3060	2848	rundll32.exe	30
PID 2848 wrote to memory of 3060	2848	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33b8751fc9672edacafae1d8491c0473_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33b8751fc9672edacafae1d8491c0473_JaffaCakes118.dll,#1
  2⤵
  PID:3060

memory/3060-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/3060-2-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/3060-1-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download