ce486fb62417c8c2c2f1bc8a18e49fcff365cb743050ee325e1186dd1fac8f6a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 11:29

Target

38eea221cf131e4a5aa702c783e2efc4_JaffaCakes118.dll
Size

188KB
MD5

38eea221cf131e4a5aa702c783e2efc4
SHA1

81f70ab72f8e16dbab6bf69b0bab67fed72d210f
SHA256

ce486fb62417c8c2c2f1bc8a18e49fcff365cb743050ee325e1186dd1fac8f6a
SHA512

8c60dc94f7b6793ede5ef9fd9a460abb3e48c8800200c27154c506800b395745e7797a2330d71ef272483721fc1a45e05b3e206e5fc21b9cd2530dcba4832cae
SSDEEP

3072:08cpg+NnXvU+2tD5rtNvUY9Da4J4Z/vmhZT8MZKs:08GpNnXSvU34J4ZQZT8Bs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2300	2172	rundll32.exe	30
PID 2172 wrote to memory of 2300	2172	rundll32.exe	30
PID 2172 wrote to memory of 2300	2172	rundll32.exe	30
PID 2172 wrote to memory of 2300	2172	rundll32.exe	30
PID 2172 wrote to memory of 2300	2172	rundll32.exe	30
PID 2172 wrote to memory of 2300	2172	rundll32.exe	30
PID 2172 wrote to memory of 2300	2172	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38eea221cf131e4a5aa702c783e2efc4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38eea221cf131e4a5aa702c783e2efc4_JaffaCakes118.dll,#1
  2⤵
  PID:2300

memory/2300-1-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download
memory/2300-0-0x0000000000100000-0x0000000000106000-memory.dmp

Filesize
24KB

Download