f1723e770609578a8de2e248a086117eda3aa357632ea806d374e8b115c94430

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 14:57

Target

3533c6d28c4ccbabe0b03252a1d2ae2a_JaffaCakes118.dll
Size

15KB
MD5

3533c6d28c4ccbabe0b03252a1d2ae2a
SHA1

1b846ec0a658f2bc99834a28e27cfa93cb45ccd7
SHA256

f1723e770609578a8de2e248a086117eda3aa357632ea806d374e8b115c94430
SHA512

9c0634687beaec514cd22b5bf1ce5dd5ef80602b8941d22b2679e8fc76640b56847b0b2991e4dc2334faa564d400917f8e7719608cb9371bc26f6f6ba430caf9
SSDEEP

384:8/gSp5fYn87BBVlTYxyPNzonEX8UkKo7X:8rRS8tB7Yx0X8UToz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2240	2092	rundll32.exe	30
PID 2092 wrote to memory of 2240	2092	rundll32.exe	30
PID 2092 wrote to memory of 2240	2092	rundll32.exe	30
PID 2092 wrote to memory of 2240	2092	rundll32.exe	30
PID 2092 wrote to memory of 2240	2092	rundll32.exe	30
PID 2092 wrote to memory of 2240	2092	rundll32.exe	30
PID 2092 wrote to memory of 2240	2092	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3533c6d28c4ccbabe0b03252a1d2ae2a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3533c6d28c4ccbabe0b03252a1d2ae2a_JaffaCakes118.dll,#1
  2⤵
  PID:2240

memory/2240-0-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/2240-1-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download