77285489793fb44ea58352bb341a5ae24154035faedc62a71132b6b38a07b23f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 19:59

Target

3a86335d0cfdd1ebb7e5a3cd74e568d0_JaffaCakes118.dll
Size

238KB
MD5

3a86335d0cfdd1ebb7e5a3cd74e568d0
SHA1

a863db87c491f5f203f3b6efa8302f2800eba0a9
SHA256

77285489793fb44ea58352bb341a5ae24154035faedc62a71132b6b38a07b23f
SHA512

86387d64c55cc6b86fc88a8dcfef13a8bea8cbf12c24f77cc47e9f76f2cd413eab8276c949961afe5b43009db48059207d79549749ed189889257caed27b76b1
SSDEEP

3072:myjnIT9IDtodEBUHwQX/XQBUAq2WV7Kl78J6kWtygRUAUXwSbiLnp2T+:myj4Sr6Hwo4RqhVGmDmyq1UgSOLI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2588	2416	rundll32.exe	30
PID 2416 wrote to memory of 2588	2416	rundll32.exe	30
PID 2416 wrote to memory of 2588	2416	rundll32.exe	30
PID 2416 wrote to memory of 2588	2416	rundll32.exe	30
PID 2416 wrote to memory of 2588	2416	rundll32.exe	30
PID 2416 wrote to memory of 2588	2416	rundll32.exe	30
PID 2416 wrote to memory of 2588	2416	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a86335d0cfdd1ebb7e5a3cd74e568d0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a86335d0cfdd1ebb7e5a3cd74e568d0_JaffaCakes118.dll,#1
  2⤵
  PID:2588

memory/2588-0-0x0000000002240000-0x0000000002280000-memory.dmp

Filesize
256KB

Download
memory/2588-1-0x000000007465E000-0x000000007465F000-memory.dmp

Filesize
4KB

Download
memory/2588-2-0x0000000002280000-0x00000000022C4000-memory.dmp

Filesize
272KB

Download