48801e8f72e82921a1ae93931e9a86f601387a350640c486fc796af537efdd12

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 04:44

Target

37be61de7218804ef16dbfc4021bcb5a_JaffaCakes118.dll
Size

22KB
MD5

37be61de7218804ef16dbfc4021bcb5a
SHA1

86d4314f2a918e72647e1ee155620606def38955
SHA256

48801e8f72e82921a1ae93931e9a86f601387a350640c486fc796af537efdd12
SHA512

528d3f7f3df3c7cc71bcacaeaf41911d7279b3b2835fcbf52c18ccb75cbfa5a47a3cf959336551ba089a3227b81c8472993ba558700ee88da919d0f1b7abf72d
SSDEEP

384:8BwgKpNalAgPBhIMsK1Atfs6ASN0WR8Q6tq0AaebhXFLScQ9an:TzbaZvIMsKQs6R0hQ6th5ebHLScD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 2660	1424	rundll32.exe	31
PID 1424 wrote to memory of 2660	1424	rundll32.exe	31
PID 1424 wrote to memory of 2660	1424	rundll32.exe	31
PID 1424 wrote to memory of 2660	1424	rundll32.exe	31
PID 1424 wrote to memory of 2660	1424	rundll32.exe	31
PID 1424 wrote to memory of 2660	1424	rundll32.exe	31
PID 1424 wrote to memory of 2660	1424	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37be61de7218804ef16dbfc4021bcb5a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\37be61de7218804ef16dbfc4021bcb5a_JaffaCakes118.dll,#1
  2⤵
  PID:2660

memory/2660-0-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2660-3-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2660-2-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2660-1-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download