58e99a36518aab1393da169dab8de9ae6afe86e8e831269fc1d880ac959bc7a5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 19:26

Target

36110e9f5ed07ac2df932322f0238d06_JaffaCakes118.dll
Size

135KB
MD5

36110e9f5ed07ac2df932322f0238d06
SHA1

d4fe4cb3c0dcac5744087e075e542a417c034871
SHA256

58e99a36518aab1393da169dab8de9ae6afe86e8e831269fc1d880ac959bc7a5
SHA512

768bf89338fd4b02a9840c7b5499d12fbab1422ed21b8bd3e8b8db0d0a8ade6959851f6f1a14542582e82ea917bb9de73ddf0d27d8c39420e58cb253ee038b13
SSDEEP

3072:E6qj0gOJSyeH9V4jUgmXs7M49f0FvlyHvpkXGSCk+RgNJJI:iWJZ6n45Ks7MUfAyHBFSb+RwJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2304	3068	rundll32.exe	30
PID 3068 wrote to memory of 2304	3068	rundll32.exe	30
PID 3068 wrote to memory of 2304	3068	rundll32.exe	30
PID 3068 wrote to memory of 2304	3068	rundll32.exe	30
PID 3068 wrote to memory of 2304	3068	rundll32.exe	30
PID 3068 wrote to memory of 2304	3068	rundll32.exe	30
PID 3068 wrote to memory of 2304	3068	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36110e9f5ed07ac2df932322f0238d06_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36110e9f5ed07ac2df932322f0238d06_JaffaCakes118.dll,#1
  2⤵
  PID:2304

memory/2304-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2304-1-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download