03bd693695ad6a8776333c7f1d62f66a841b6eaf86f32970d07afca0e9b5910a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 12:48

Target

392d77fa0627db36566ff86dcc1032ed_JaffaCakes118.dll
Size

10KB
MD5

392d77fa0627db36566ff86dcc1032ed
SHA1

c30d1fea54993ee5d675dabeab4df5d90759605f
SHA256

03bd693695ad6a8776333c7f1d62f66a841b6eaf86f32970d07afca0e9b5910a
SHA512

8f56edb812cdadc96186e5cc5b0eb7a694146e377ff61a51796970d605ea04b0daf1245559b7c9f70182d8045dae095e36cc31f3b62fb1dacc03e520e045a1eb
SSDEEP

192:j6ugjOSp/QtxDJYqkoo7FVQ43tqpO/VGsrY1Y12MBLMQdjgNpNk2Ski1x:8KSp/QtxDWq6RVhtJgmY1i2MBL6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 1604	2548	rundll32.exe	30
PID 2548 wrote to memory of 1604	2548	rundll32.exe	30
PID 2548 wrote to memory of 1604	2548	rundll32.exe	30
PID 2548 wrote to memory of 1604	2548	rundll32.exe	30
PID 2548 wrote to memory of 1604	2548	rundll32.exe	30
PID 2548 wrote to memory of 1604	2548	rundll32.exe	30
PID 2548 wrote to memory of 1604	2548	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\392d77fa0627db36566ff86dcc1032ed_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\392d77fa0627db36566ff86dcc1032ed_JaffaCakes118.dll,#1
  2⤵
  PID:1604

memory/1604-1-0x0000000010001000-0x0000000010002000-memory.dmp

Filesize
4KB

Download
memory/1604-0-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download