45adc49aa6c404e449ec1c2a9a6b60076b912ca580e72e06745b26ab35b3350a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 01:42

Target

3b8aa5e57117302a74fcd9f88876a4f0_JaffaCakes118.dll
Size

180KB
MD5

3b8aa5e57117302a74fcd9f88876a4f0
SHA1

af78b720ce4b37a9c4f65b2dbb43d54c0c02f49f
SHA256

45adc49aa6c404e449ec1c2a9a6b60076b912ca580e72e06745b26ab35b3350a
SHA512

716e372f9f6b0b10d1d731e41eeccb260762cdf7d0140b2442c1fb4e4246df94beb165605c91664ff9e15f0d1c3d814e3077901a876f4b0cc5744e9e8ed6ca0a
SSDEEP

1536:+vYWQhY/8rbNjDTUc6sz94QAClo8J78RAQjuG:+umoCkkClo8uRAQS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2344	2660	rundll32.exe	30
PID 2660 wrote to memory of 2344	2660	rundll32.exe	30
PID 2660 wrote to memory of 2344	2660	rundll32.exe	30
PID 2660 wrote to memory of 2344	2660	rundll32.exe	30
PID 2660 wrote to memory of 2344	2660	rundll32.exe	30
PID 2660 wrote to memory of 2344	2660	rundll32.exe	30
PID 2660 wrote to memory of 2344	2660	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b8aa5e57117302a74fcd9f88876a4f0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b8aa5e57117302a74fcd9f88876a4f0_JaffaCakes118.dll,#1
  2⤵
  PID:2344

memory/2344-0-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/2344-1-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/2344-2-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download