d943a9cb72bede506dca958482a1736de47b57ee578efa4223853ea0a535564b

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 22:55

Target

3b0aafc1c15ca0e24ad6eb1d5f195b65_JaffaCakes118.dll
Size

86KB
MD5

3b0aafc1c15ca0e24ad6eb1d5f195b65
SHA1

f296138beb90eb0213d46022cd266472045d159d
SHA256

d943a9cb72bede506dca958482a1736de47b57ee578efa4223853ea0a535564b
SHA512

fedfb41d3854dfe1681aa0856e5d8e9a86cf3b6a94f04f3600176148c068a33337a6e55afd85bd9bcfddf96ee584f20d498e58514cea3c9fbf90cd20ddba9b85
SSDEEP

1536:bq+dX5z9lhsRbarmsapZyWK+0IStWJ+xruajIDUsL+JjiHq0VaO1FsPRFDmu+T4:bbdRhsRwmsmB4tCailUsLHq0VaODQD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1412	2528	rundll32.exe	30
PID 2528 wrote to memory of 1412	2528	rundll32.exe	30
PID 2528 wrote to memory of 1412	2528	rundll32.exe	30
PID 2528 wrote to memory of 1412	2528	rundll32.exe	30
PID 2528 wrote to memory of 1412	2528	rundll32.exe	30
PID 2528 wrote to memory of 1412	2528	rundll32.exe	30
PID 2528 wrote to memory of 1412	2528	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b0aafc1c15ca0e24ad6eb1d5f195b65_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b0aafc1c15ca0e24ad6eb1d5f195b65_JaffaCakes118.dll,#1
  2⤵
  PID:1412

memory/1412-2-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/1412-1-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/1412-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download