bcde34066569711eb3104aefedcf75cf93d7b818847b4cd57ccaa541bc550b27

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 19:31

Target

3a73c3855f0a35db136394f0993f5a61_JaffaCakes118.dll
Size

34KB
MD5

3a73c3855f0a35db136394f0993f5a61
SHA1

1bc17ca8de4ab0a7b026ceca22485107639ef465
SHA256

bcde34066569711eb3104aefedcf75cf93d7b818847b4cd57ccaa541bc550b27
SHA512

da444e0688593a5cd11939a70880f590ce51614b420b06389e6ba05b15441c11cdb388901a73f069835833472caf4f344b05260196ce280734fb7128e2e3b447
SSDEEP

768:Grw22Cv+j2+/dJyI/B+AHy2mIL0qt1fnXZ1l5wE+eg:Gh2w+BdQIDHyZIL0oVXZvKHeg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1980	2072	rundll32.exe	30
PID 2072 wrote to memory of 1980	2072	rundll32.exe	30
PID 2072 wrote to memory of 1980	2072	rundll32.exe	30
PID 2072 wrote to memory of 1980	2072	rundll32.exe	30
PID 2072 wrote to memory of 1980	2072	rundll32.exe	30
PID 2072 wrote to memory of 1980	2072	rundll32.exe	30
PID 2072 wrote to memory of 1980	2072	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a73c3855f0a35db136394f0993f5a61_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a73c3855f0a35db136394f0993f5a61_JaffaCakes118.dll,#1
  2⤵
  PID:1980

memory/1980-2-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1980-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1980-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1980-3-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download