99599e4f8fe834a44dfef430cf65489396add1f56d8c7a0b4fab43aadacb4d78

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 10:07

Target

38afbe230f1f0f233f46cfe181d42a5d_JaffaCakes118.dll
Size

56KB
MD5

38afbe230f1f0f233f46cfe181d42a5d
SHA1

0a735b2704caed82f6d5e20c1b0bfd293e13253a
SHA256

99599e4f8fe834a44dfef430cf65489396add1f56d8c7a0b4fab43aadacb4d78
SHA512

e5dad90d91d0d0f58810e46eb51cab4680ad585a0516730a9920337c1f6a91d739b89540d25a16726a9f7b06159f3ae6efbd47c0c9c0172e89d5c3fa2ef8ad5e
SSDEEP

768:1pON/xpyeAXo9JEAUmr0JhbKtw8MA6XTzCuJe:uN/CposThb+w8fmCA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2536	3036	rundll32.exe	30
PID 3036 wrote to memory of 2536	3036	rundll32.exe	30
PID 3036 wrote to memory of 2536	3036	rundll32.exe	30
PID 3036 wrote to memory of 2536	3036	rundll32.exe	30
PID 3036 wrote to memory of 2536	3036	rundll32.exe	30
PID 3036 wrote to memory of 2536	3036	rundll32.exe	30
PID 3036 wrote to memory of 2536	3036	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38afbe230f1f0f233f46cfe181d42a5d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38afbe230f1f0f233f46cfe181d42a5d_JaffaCakes118.dll,#1
  2⤵
  PID:2536

memory/2536-0-0x0000000010001000-0x0000000010002000-memory.dmp

Filesize
4KB

Download
memory/2536-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download