ffb9a3d852fbe8b5259c9b39ef3f83f5e6f47cfa6bebe04d6337f273d8595557

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 23:03

Target

3f397bd3834bd623c02198c522041d02_JaffaCakes118.dll
Size

314KB
MD5

3f397bd3834bd623c02198c522041d02
SHA1

2260d600e70ad8e4aba9106af42ec827322e1631
SHA256

ffb9a3d852fbe8b5259c9b39ef3f83f5e6f47cfa6bebe04d6337f273d8595557
SHA512

4094ce659547bd9f77400c158362f245412b9ca213756e1ae79862058b07eb885fc837b6568f193830022fd800bdafbae8973c3e2f52a1210c14da9b7674b3d2
SSDEEP

6144:iMjsycyX7bweBe/K6iCI5adO/WwkfiKTAQE6MIA+3NUSSX:iMjsycC47iCI5oqPc5MIx6SSX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 1376	2068	rundll32.exe	30
PID 2068 wrote to memory of 1376	2068	rundll32.exe	30
PID 2068 wrote to memory of 1376	2068	rundll32.exe	30
PID 2068 wrote to memory of 1376	2068	rundll32.exe	30
PID 2068 wrote to memory of 1376	2068	rundll32.exe	30
PID 2068 wrote to memory of 1376	2068	rundll32.exe	30
PID 2068 wrote to memory of 1376	2068	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f397bd3834bd623c02198c522041d02_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f397bd3834bd623c02198c522041d02_JaffaCakes118.dll,#1
  2⤵
  PID:1376

memory/1376-0-0x0000000010000000-0x000000001009D000-memory.dmp

Filesize
628KB

Download
memory/1376-1-0x0000000010000000-0x000000001009D000-memory.dmp

Filesize
628KB

Download