7d111a8b5f3a320395b88504d8cb5c90364d0d8c1fef462bc2933f9c6cfe55f9

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 21:10

Target

36654474c6ff82082ca14ecf69145a28_JaffaCakes118.dll
Size

9KB
MD5

36654474c6ff82082ca14ecf69145a28
SHA1

47f3b7078633dcbdf26142a2ccf3a5405be2fb7a
SHA256

7d111a8b5f3a320395b88504d8cb5c90364d0d8c1fef462bc2933f9c6cfe55f9
SHA512

b22e1d419db22659b2fc1c5348f3324b7c890231b4a8cf0e5231621db8aa58f8da304a05c8bccf4ed7834ffc151934f8f50cdd61f70e466a0192b97df5bb9c05
SSDEEP

96:qJV7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG3Sv:wuwEt8rsTUtPLzKNWSYWFSv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2176 wrote to memory of 2304	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 2304	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 2304	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 2304	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 2304	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 2304	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 2304	2176	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36654474c6ff82082ca14ecf69145a28_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36654474c6ff82082ca14ecf69145a28_JaffaCakes118.dll,#1
2⤵
PID:2304

memory/2304-0-0x0000000000160000-0x0000000000167000-memory.dmp

Filesize
28KB

Download
memory/2304-3-0x00000000001B0000-0x00000000001B7000-memory.dmp

Filesize
28KB

Download
memory/2304-2-0x0000000000160000-0x0000000000167000-memory.dmp

Filesize
28KB

Download
memory/2304-1-0x0000000000160000-0x0000000000167000-memory.dmp

Filesize
28KB

Download