1dd56b566b3cc3b7cc71d042ce7c29e795c49868150287686ce5f818da74f0d1

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 02:47

Target

37694a2e780e30fb5db22323c2271ff6_JaffaCakes118.dll
Size

135KB
MD5

37694a2e780e30fb5db22323c2271ff6
SHA1

9d103b66ad75e77fed3789a7c54b16c08b4c5002
SHA256

1dd56b566b3cc3b7cc71d042ce7c29e795c49868150287686ce5f818da74f0d1
SHA512

d408df63a2c5a814dc6a67c6e06d9a2b4e0a397ffd971a31826b1848077f9ff66f37cfd597f54f0b3764b1e33dcc7d4725be87d0043ebab38942bc7cd0ce4c8a
SSDEEP

1536:mBEJmiprN9QlXgo2hw+fPgU79MX8bf4x97D6bMycQt3QbgwY42VHAFiGLRzmQSPt:mEBlPQFvwAAozmQ+RPO8OQ2C

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2352	2692	rundll32.exe	30
PID 2692 wrote to memory of 2352	2692	rundll32.exe	30
PID 2692 wrote to memory of 2352	2692	rundll32.exe	30
PID 2692 wrote to memory of 2352	2692	rundll32.exe	30
PID 2692 wrote to memory of 2352	2692	rundll32.exe	30
PID 2692 wrote to memory of 2352	2692	rundll32.exe	30
PID 2692 wrote to memory of 2352	2692	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37694a2e780e30fb5db22323c2271ff6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\37694a2e780e30fb5db22323c2271ff6_JaffaCakes118.dll,#1
  2⤵
  PID:2352

memory/2352-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download