8d6da960d57c928776e6df982194884ec6eececf11b4c71cb62463025a477c8d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 04:57

Target

37c7eedb01ac92f80807ba673f094d96_JaffaCakes118.dll
Size

106KB
MD5

37c7eedb01ac92f80807ba673f094d96
SHA1

975e6e18b4ac5653b36b67a129525e58c645a6a0
SHA256

8d6da960d57c928776e6df982194884ec6eececf11b4c71cb62463025a477c8d
SHA512

8b2b96693e041d8edcfe39fb24958bcf9691b921dc1b3b6782cb4a76787495035e1efdf96988319a96dcbfae5689bbe2b859927ced81b8a4cb5feb18ea7aebff
SSDEEP

1536:S+N8E5/7qGGp2dNmD+fI5yAVXBLc8fK0QukNcoI13DXo925bVn+KuwqjEwy:ME5/7qGhTi5PxLcKjJkNcbzCIVnijEN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 3036	3024	rundll32.exe	31
PID 3024 wrote to memory of 3036	3024	rundll32.exe	31
PID 3024 wrote to memory of 3036	3024	rundll32.exe	31
PID 3024 wrote to memory of 3036	3024	rundll32.exe	31
PID 3024 wrote to memory of 3036	3024	rundll32.exe	31
PID 3024 wrote to memory of 3036	3024	rundll32.exe	31
PID 3024 wrote to memory of 3036	3024	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37c7eedb01ac92f80807ba673f094d96_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\37c7eedb01ac92f80807ba673f094d96_JaffaCakes118.dll,#1
  2⤵
  PID:3036

memory/3036-4-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download
memory/3036-3-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/3036-2-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/3036-1-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/3036-0-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download