514252b832315da70f4f5b441e3e51901bbea44a68247984fd73e9ec9aac25e7

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 14:27

Target

3982556388c33b864488dad398bd7a6b_JaffaCakes118.dll
Size

2.0MB
MD5

3982556388c33b864488dad398bd7a6b
SHA1

cde83c2774966a809750059faebb1e3fba81bb76
SHA256

514252b832315da70f4f5b441e3e51901bbea44a68247984fd73e9ec9aac25e7
SHA512

8a189db92fdf780de1db15ef7819fb82a6c8dba9bf4716d6980ec0903acd56ff46655fcbd43c1b5d489eda673324a1bcfc4868f8fd71c7dfeba986e4bed73ab3
SSDEEP

49152:oILLEZVk6y3tQu2XG8ZoI9Z9rqyI44HppuzGT:qZ26y3SWGoqZ92yVG/uzGT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2708	2656	rundll32.exe	30
PID 2656 wrote to memory of 2708	2656	rundll32.exe	30
PID 2656 wrote to memory of 2708	2656	rundll32.exe	30
PID 2656 wrote to memory of 2708	2656	rundll32.exe	30
PID 2656 wrote to memory of 2708	2656	rundll32.exe	30
PID 2656 wrote to memory of 2708	2656	rundll32.exe	30
PID 2656 wrote to memory of 2708	2656	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3982556388c33b864488dad398bd7a6b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3982556388c33b864488dad398bd7a6b_JaffaCakes118.dll,#1
  2⤵
  PID:2708

memory/2708-0-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download