3bb5fda51b462069647db633b62a28e46de2efaa6ab11d600c10fab00337ad99

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 12:18

Target

34afa5e0d9afed72fc9e6a27823a7153_JaffaCakes118.dll
Size

96KB
MD5

34afa5e0d9afed72fc9e6a27823a7153
SHA1

7fabaf926dcb925f6638856543cd2d2896373730
SHA256

3bb5fda51b462069647db633b62a28e46de2efaa6ab11d600c10fab00337ad99
SHA512

eceddb15161ee7127b462bfff8661e4fe7f1e45b2dcf68a766d53cd6cdf9ab55a94fd87247666f914bc960a105b72565e8ea04896e0d6e5bc4aa6737274764ec
SSDEEP

1536:yRZdpI/IS+r8Rb9i79S0BlPKWmf2vw0EElzlBd0LvhRGeDr62Rsot6EtH:x/JRO00Bl4N0Eyznd+vhRG0+4H

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1908	2848	rundll32.exe	30
PID 2848 wrote to memory of 1908	2848	rundll32.exe	30
PID 2848 wrote to memory of 1908	2848	rundll32.exe	30
PID 2848 wrote to memory of 1908	2848	rundll32.exe	30
PID 2848 wrote to memory of 1908	2848	rundll32.exe	30
PID 2848 wrote to memory of 1908	2848	rundll32.exe	30
PID 2848 wrote to memory of 1908	2848	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\34afa5e0d9afed72fc9e6a27823a7153_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\34afa5e0d9afed72fc9e6a27823a7153_JaffaCakes118.dll,#1
  2⤵
  PID:1908

memory/1908-0-0x0000000002130000-0x0000000002347000-memory.dmp

Filesize
2.1MB

Download
memory/1908-1-0x0000000002130000-0x0000000002347000-memory.dmp

Filesize
2.1MB

Download
memory/1908-2-0x0000000010000000-0x0000000010217000-memory.dmp

Filesize
2.1MB

Download