976ceae5566c5f77b4d440229d13dc10fe94ec86cfcf6fe4ecc01aad9e4a6aed

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 21:35

Target

3ef79824f34e8195c64f57affee25c46_JaffaCakes118.dll
Size

861KB
MD5

3ef79824f34e8195c64f57affee25c46
SHA1

f2be2e070dd522102840767589408400a603f0a5
SHA256

976ceae5566c5f77b4d440229d13dc10fe94ec86cfcf6fe4ecc01aad9e4a6aed
SHA512

9adc24b01875c3458d00b473bc77a599fb4895a4c523c3f728be03e3a199128198f295e165fe1d28427de760de4307716050e06ae92b17bd6f40f547947ed8ca
SSDEEP

24576:feVyyucjuKybpZufCwT+Pr7URqnfhDnEnO01hE:GlYpEf7q5fZEnO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 2072	1108	rundll32.exe	30
PID 1108 wrote to memory of 2072	1108	rundll32.exe	30
PID 1108 wrote to memory of 2072	1108	rundll32.exe	30
PID 1108 wrote to memory of 2072	1108	rundll32.exe	30
PID 1108 wrote to memory of 2072	1108	rundll32.exe	30
PID 1108 wrote to memory of 2072	1108	rundll32.exe	30
PID 1108 wrote to memory of 2072	1108	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef79824f34e8195c64f57affee25c46_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef79824f34e8195c64f57affee25c46_JaffaCakes118.dll,#1
  2⤵
  PID:2072

memory/2072-0-0x00000000004FE000-0x0000000000500000-memory.dmp

Filesize
8KB

Download
memory/2072-1-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/2072-2-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/2072-3-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/2072-4-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download