ab45c986127a0a85e9a270599ce31dd12717c14eb8d9db71d92a3082fa0da4e8

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 01:57

Target

3b95ad8bf9423fd68f983544feb582d9_JaffaCakes118.dll
Size

6KB
MD5

3b95ad8bf9423fd68f983544feb582d9
SHA1

12976f293a749cccfaf44e5b503b57b0ca6220cb
SHA256

ab45c986127a0a85e9a270599ce31dd12717c14eb8d9db71d92a3082fa0da4e8
SHA512

686abe3842f822f0d10bf07cc14ceb1f986d15474a23e2b8f4e675ffa2db1e349f33a3d03e0452155f2b0475e680eade02da90f463f0872ddfee776e7c55d21c
SSDEEP

48:aGy7MN4cpSGAXbIni1kvNs6ztutiKIZWiwQTnU5WwG2QozbC:xB4c4G6bn1k1sw0EW3enIWwGqb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2700	2552	rundll32.exe	30
PID 2552 wrote to memory of 2700	2552	rundll32.exe	30
PID 2552 wrote to memory of 2700	2552	rundll32.exe	30
PID 2552 wrote to memory of 2700	2552	rundll32.exe	30
PID 2552 wrote to memory of 2700	2552	rundll32.exe	30
PID 2552 wrote to memory of 2700	2552	rundll32.exe	30
PID 2552 wrote to memory of 2700	2552	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b95ad8bf9423fd68f983544feb582d9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b95ad8bf9423fd68f983544feb582d9_JaffaCakes118.dll,#1
  2⤵
  PID:2700

memory/2700-3-0x0000000000170000-0x0000000000176000-memory.dmp

Filesize
24KB

Download
memory/2700-2-0x0000000000160000-0x0000000000166000-memory.dmp

Filesize
24KB

Download
memory/2700-1-0x0000000000160000-0x0000000000166000-memory.dmp

Filesize
24KB

Download
memory/2700-0-0x0000000000160000-0x0000000000166000-memory.dmp

Filesize
24KB

Download