f44215e86378788e27feae079912f1eec98541a32ecaf6a9ab773c4f8fc06624

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 21:33

Target

3ef6b55d621e0b4a81da36711a9b1539_JaffaCakes118.dll
Size

49KB
MD5

3ef6b55d621e0b4a81da36711a9b1539
SHA1

51936f8ecbd704e2dbc76cb29f61a3f8e2a69516
SHA256

f44215e86378788e27feae079912f1eec98541a32ecaf6a9ab773c4f8fc06624
SHA512

665f7e91e7fce8aca12303241284e1e5a162d46fa9eb09d718ba085ffe69ea698881451c189de49c80c8fa0297c1bebf756c09055948990cbbec036a8d8ac743
SSDEEP

768:OG9GQxT+PQbWbgKH0MotN4lbK9hbMt8QC2oUwhjbPNEMdumf+mz/F:OCIPQbovhotN4RkhY6QCPUabVDfHz/F

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2580	2128	rundll32.exe	30
PID 2128 wrote to memory of 2580	2128	rundll32.exe	30
PID 2128 wrote to memory of 2580	2128	rundll32.exe	30
PID 2128 wrote to memory of 2580	2128	rundll32.exe	30
PID 2128 wrote to memory of 2580	2128	rundll32.exe	30
PID 2128 wrote to memory of 2580	2128	rundll32.exe	30
PID 2128 wrote to memory of 2580	2128	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef6b55d621e0b4a81da36711a9b1539_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef6b55d621e0b4a81da36711a9b1539_JaffaCakes118.dll,#1
  2⤵
  PID:2580

memory/2580-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2580-2-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2580-1-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download