9a7985de3e12b583097d1606e50e91adc8a057fb24c3a6ed5395bb0fecc970a1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 11:17

Target

38e3cb8eaf6eeaf85d3877bc0a2cbfc8_JaffaCakes118.dll
Size

6KB
MD5

38e3cb8eaf6eeaf85d3877bc0a2cbfc8
SHA1

2919147d3b69ddb69eb9186d084e0bd635245966
SHA256

9a7985de3e12b583097d1606e50e91adc8a057fb24c3a6ed5395bb0fecc970a1
SHA512

c62c3e223afcd4dacf4e8a48587eb99d2444beea8120a4b6aaef30e5491505373e181f95cb82c0337e7ac3c0061ed86e6334110713f2e96773a50230b8dabff0
SSDEEP

48:aGy7MN4cpSGAXbIni1kvNs6ztutiKIZWiwQTnU5WwG2QozbC:xB4c4G6bn1k1sw0EW3enIWwGqb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1732	1928	rundll32.exe	30
PID 1928 wrote to memory of 1732	1928	rundll32.exe	30
PID 1928 wrote to memory of 1732	1928	rundll32.exe	30
PID 1928 wrote to memory of 1732	1928	rundll32.exe	30
PID 1928 wrote to memory of 1732	1928	rundll32.exe	30
PID 1928 wrote to memory of 1732	1928	rundll32.exe	30
PID 1928 wrote to memory of 1732	1928	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38e3cb8eaf6eeaf85d3877bc0a2cbfc8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38e3cb8eaf6eeaf85d3877bc0a2cbfc8_JaffaCakes118.dll,#1
  2⤵
  PID:1732

memory/1732-2-0x0000000000130000-0x0000000000136000-memory.dmp

Filesize
24KB

Download
memory/1732-3-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/1732-1-0x0000000000130000-0x0000000000136000-memory.dmp

Filesize
24KB

Download
memory/1732-0-0x0000000000130000-0x0000000000136000-memory.dmp

Filesize
24KB

Download