ae520c2220ad0db96462843ab04a00a34062fd9aa2ba942eb890adbc1ccc9d68

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 10:47

Target

38cd0683f6747042f5ef0ee6508ebdeb_JaffaCakes118.dll
Size

42KB
MD5

38cd0683f6747042f5ef0ee6508ebdeb
SHA1

c093c433ff1f8b890d690adb11bdd5b4e92d6484
SHA256

ae520c2220ad0db96462843ab04a00a34062fd9aa2ba942eb890adbc1ccc9d68
SHA512

1d27c6870e438dae42a48573a4ce2bc85d1af62be519d1c59dc9055f1550f9fe39f768d877928da34015bfd345293aa2dae14051a7240424de87fba30d4faaad
SSDEEP

768:oZlX07Q1h9nyW6E/oO/HwhiUwY+LNm5PacT3s85PKxf/4gR:orE7Qb9nd6EgMHw3wjozERR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 2396	1000	rundll32.exe	31
PID 1000 wrote to memory of 2396	1000	rundll32.exe	31
PID 1000 wrote to memory of 2396	1000	rundll32.exe	31
PID 1000 wrote to memory of 2396	1000	rundll32.exe	31
PID 1000 wrote to memory of 2396	1000	rundll32.exe	31
PID 1000 wrote to memory of 2396	1000	rundll32.exe	31
PID 1000 wrote to memory of 2396	1000	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38cd0683f6747042f5ef0ee6508ebdeb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38cd0683f6747042f5ef0ee6508ebdeb_JaffaCakes118.dll,#1
  2⤵
  PID:2396

memory/2396-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/2396-4-0x0000000000170000-0x0000000000178000-memory.dmp

Filesize
32KB

Download
memory/2396-3-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/2396-2-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/2396-1-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download