12fc9c997754be1ca81255742c5e23eed63105c4fac76b153a9616d7da785aee

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 03:43

Target

3bdf6a9f1e00f3aa493cfd40bcd934d4_JaffaCakes118.dll
Size

296KB
MD5

3bdf6a9f1e00f3aa493cfd40bcd934d4
SHA1

3e37dc76e84b09b6b8fe412176c015311a953f1a
SHA256

12fc9c997754be1ca81255742c5e23eed63105c4fac76b153a9616d7da785aee
SHA512

158db5b1b9790855456fd732675a3b4cc272e120987823b97e8b67c245847adc29a47ee95e2b2a8910224f6219ead1e8b131704717c2a6c5507838f4301b3738
SSDEEP

6144:J0AYvwcyyRwkThPLbUtd7P/1ZaiBfFTZyd/i+G:S8yRu1Z1N1yd/i+G

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1868	1296	rundll32.exe	30
PID 1296 wrote to memory of 1868	1296	rundll32.exe	30
PID 1296 wrote to memory of 1868	1296	rundll32.exe	30
PID 1296 wrote to memory of 1868	1296	rundll32.exe	30
PID 1296 wrote to memory of 1868	1296	rundll32.exe	30
PID 1296 wrote to memory of 1868	1296	rundll32.exe	30
PID 1296 wrote to memory of 1868	1296	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bdf6a9f1e00f3aa493cfd40bcd934d4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bdf6a9f1e00f3aa493cfd40bcd934d4_JaffaCakes118.dll,#1
  2⤵
  PID:1868

memory/1868-2-0x0000000000170000-0x0000000000175000-memory.dmp

Filesize
20KB

Download
memory/1868-1-0x0000000010000000-0x000000001009E000-memory.dmp

Filesize
632KB

Download
memory/1868-0-0x0000000010000000-0x000000001009E000-memory.dmp

Filesize
632KB

Download