445b7d77c9cf4d91b3f341a3bed67308b3805db8e9878d6fe6a79a14b092bd11

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 14:45

Target

398f102830cbf07eaef577fd59c0228f_JaffaCakes118.dll
Size

34KB
MD5

398f102830cbf07eaef577fd59c0228f
SHA1

cf62453e1e50be7db8f0ad685d3758ffc359d80a
SHA256

445b7d77c9cf4d91b3f341a3bed67308b3805db8e9878d6fe6a79a14b092bd11
SHA512

4eb31a73b81eadeafa0042ba9078cd44f77421ab43ccc94994512e92f414e7839ea4c4021d5d5e2f6b28e2e49adbb6ac93a758215ea0aa6a59f560ba1805bf14
SSDEEP

384:gtlXqmGkyOdncnHRp9p0WTq7z/rmHKwE0AUqc0bz:gfOkyOdncHRZdTwKqwE0Mrb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1920	1724	rundll32.exe	30
PID 1724 wrote to memory of 1920	1724	rundll32.exe	30
PID 1724 wrote to memory of 1920	1724	rundll32.exe	30
PID 1724 wrote to memory of 1920	1724	rundll32.exe	30
PID 1724 wrote to memory of 1920	1724	rundll32.exe	30
PID 1724 wrote to memory of 1920	1724	rundll32.exe	30
PID 1724 wrote to memory of 1920	1724	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\398f102830cbf07eaef577fd59c0228f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\398f102830cbf07eaef577fd59c0228f_JaffaCakes118.dll,#1
  2⤵
  PID:1920

memory/1920-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1920-3-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1920-2-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1920-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download