cd95d017659b0058c0de9fcfbe8a85ffc9b4c97d5470c3761279efc3b3d2b5c2

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 17:53

Target

35c5f648f4538b6827d6fecd26e830c2_JaffaCakes118.dll
Size

6KB
MD5

35c5f648f4538b6827d6fecd26e830c2
SHA1

bdc5bab74574c1d996a1a8bbbd0b11178b7271cb
SHA256

cd95d017659b0058c0de9fcfbe8a85ffc9b4c97d5470c3761279efc3b3d2b5c2
SHA512

5ecdcbe66c51049a1359100111f69fdd25f7ff4b5793e09900ade9862fb4bfb5a77ee84016e65169c1b460dd6ff6ef9dd2cbd50e7738c41ac105c1d99290f141
SSDEEP

96:tudFce2Wsn2tuPXTMYGKG3ljAvWC61WnV+k8ZH1DnsJBX9K8u:kdrs2tmXTXW3l0vdV+hZHOJxI8u

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2840	2900	rundll32.exe	30
PID 2900 wrote to memory of 2840	2900	rundll32.exe	30
PID 2900 wrote to memory of 2840	2900	rundll32.exe	30
PID 2900 wrote to memory of 2840	2900	rundll32.exe	30
PID 2900 wrote to memory of 2840	2900	rundll32.exe	30
PID 2900 wrote to memory of 2840	2900	rundll32.exe	30
PID 2900 wrote to memory of 2840	2900	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35c5f648f4538b6827d6fecd26e830c2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\35c5f648f4538b6827d6fecd26e830c2_JaffaCakes118.dll,#1
  2⤵
  PID:2840

memory/2840-0-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/2840-2-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/2840-1-0x0000000010007000-0x0000000010008000-memory.dmp

Filesize
4KB

Download