975f9d2a3ab2d99acd606b7766bd498618e2170f24595f23838a812ca48e407d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 19:14

Target

3a67b90339095bde12d3dcce90089b54_JaffaCakes118.dll
Size

136KB
MD5

3a67b90339095bde12d3dcce90089b54
SHA1

cd16bf8fd077b75afcdad7d4f039b1b039d6711b
SHA256

975f9d2a3ab2d99acd606b7766bd498618e2170f24595f23838a812ca48e407d
SHA512

f2c62678a32a66a7b2bba6beac5c7c1631eaf149dd0d432e4f51dbb1db691e2fd49ddc23d9c11c80f6e49b43ad1f43b745f486d2bcf0685bad88eaa5e3b46f9a
SSDEEP

3072:I/DvZH/hrmi/doOeOFVuw0XX59jVbwj1CFyafQJWzvX2o6Zfqb:IDNhq0zGw0XX5fwjIFLwWzfEfq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2384	2476	rundll32.exe	30
PID 2476 wrote to memory of 2384	2476	rundll32.exe	30
PID 2476 wrote to memory of 2384	2476	rundll32.exe	30
PID 2476 wrote to memory of 2384	2476	rundll32.exe	30
PID 2476 wrote to memory of 2384	2476	rundll32.exe	30
PID 2476 wrote to memory of 2384	2476	rundll32.exe	30
PID 2476 wrote to memory of 2384	2476	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a67b90339095bde12d3dcce90089b54_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a67b90339095bde12d3dcce90089b54_JaffaCakes118.dll,#1
  2⤵
  PID:2384

memory/2384-0-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/2384-4-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/2384-5-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download