2d54fff927e61071866458abda1c887b7007b5208ad10767ea814b45f5364d85

Analysis

max time kernel
15s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 19:13

Target

3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll
Size

19KB
MD5

3a6749d378e53fd505b060c1501e12cc
SHA1

c1d4ba15edb88855d88d2e991d0b47cc54ebd9e4
SHA256

2d54fff927e61071866458abda1c887b7007b5208ad10767ea814b45f5364d85
SHA512

5be2ca06e047e4583097e149faefddfd797ac7134d0de8f4a30c48e6fae171ef7b0dcf2ee80167273dd6957f4fdc75f62ac69249cb33bd5572bd0b2d67f962f5
SSDEEP

384:D1lREHt4rgAbgzCMVrx00nH3ZUX0V+FA1EocPK2iJ8uPg7wQF:DKHtRZCcpyX0coEoc5uSF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2300	2400	rundll32.exe	29
PID 2400 wrote to memory of 2300	2400	rundll32.exe	29
PID 2400 wrote to memory of 2300	2400	rundll32.exe	29
PID 2400 wrote to memory of 2300	2400	rundll32.exe	29
PID 2400 wrote to memory of 2300	2400	rundll32.exe	29
PID 2400 wrote to memory of 2300	2400	rundll32.exe	29
PID 2400 wrote to memory of 2300	2400	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1
  2⤵
  PID:2300

memory/2300-3-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2300-2-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2300-1-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2300-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download