b4fcdc55ff536a871110cf00420fcfa313df8715db7f4d7c217a2bf169af1ebf

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 16:50

Target

35916dea658143808d51d1f0d473b22b_JaffaCakes118.dll
Size

79KB
MD5

35916dea658143808d51d1f0d473b22b
SHA1

9c6602fbcf6dd16d3c93f6ee7fac36890ab45139
SHA256

b4fcdc55ff536a871110cf00420fcfa313df8715db7f4d7c217a2bf169af1ebf
SHA512

fbfd795ba262d2ccbc8d584fb796dcdee20756cf1c7d051484303747b9ccddb71968287b00062309af13db03a07124c38ca1fdf9b241d217db4198372df48ae5
SSDEEP

1536:n1P3M7oe6wdFD64eAMtvrs5BcD4FTYYuG+EkTt9kL+t8uF2d:n107D6EDVWvrs5S0iYz+vt9NtQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2504	2084	rundll32.exe	30
PID 2084 wrote to memory of 2504	2084	rundll32.exe	30
PID 2084 wrote to memory of 2504	2084	rundll32.exe	30
PID 2084 wrote to memory of 2504	2084	rundll32.exe	30
PID 2084 wrote to memory of 2504	2084	rundll32.exe	30
PID 2084 wrote to memory of 2504	2084	rundll32.exe	30
PID 2084 wrote to memory of 2504	2084	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35916dea658143808d51d1f0d473b22b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\35916dea658143808d51d1f0d473b22b_JaffaCakes118.dll,#1
  2⤵
  PID:2504

memory/2504-2-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2504-3-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2504-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2504-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download