18aeec3734ef1b5752131b18baf17fe67ec7a64ab66ac993c39b6de9c951774d

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 16:27

Target

39e38ce2d24172815b4132606faae87d_JaffaCakes118.dll
Size

28KB
MD5

39e38ce2d24172815b4132606faae87d
SHA1

62daf097949b89545de2c79ca14f0bbf3161e75a
SHA256

18aeec3734ef1b5752131b18baf17fe67ec7a64ab66ac993c39b6de9c951774d
SHA512

03729b53b27cd35a71b62554048b4fff4c5e99fe8201214920bb0349d08118820ac2bb382546da93b91ae2a80cf9f55c788d9a32193b2d85872ec64d08b20a20
SSDEEP

384:MHrHFzrX6jtIlLqiDhYz8djAm0ShD8nEgaVBCeCdy9kjQKLNXj79Glh3z1Ihl:MLlzrGuIitYzWEFANmty9+BNXj7slBol

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2264	2208	rundll32.exe	30
PID 2208 wrote to memory of 2264	2208	rundll32.exe	30
PID 2208 wrote to memory of 2264	2208	rundll32.exe	30
PID 2208 wrote to memory of 2264	2208	rundll32.exe	30
PID 2208 wrote to memory of 2264	2208	rundll32.exe	30
PID 2208 wrote to memory of 2264	2208	rundll32.exe	30
PID 2208 wrote to memory of 2264	2208	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39e38ce2d24172815b4132606faae87d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39e38ce2d24172815b4132606faae87d_JaffaCakes118.dll,#1
  2⤵
  PID:2264

memory/2264-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download