c327dcae138986a87f5047b1784c9edac201c1964ae752b182a3d532506d757f

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 03:26

Target

3bd3cfce4337fedece6179cc35a0f0fe_JaffaCakes118.dll
Size

295KB
MD5

3bd3cfce4337fedece6179cc35a0f0fe
SHA1

00c0efbd3122b10e3c10f0d5301b6e050a0be7f6
SHA256

c327dcae138986a87f5047b1784c9edac201c1964ae752b182a3d532506d757f
SHA512

df6dda530e8b65752e684ea36f9470aa943e6eb51d4bac9b1c0fa9d3c42a2f058018275ca5fef3e0eacd5831de1dfde27b1cd37006c3b3d3a482553fdb5b9d3a
SSDEEP

6144:2wcCuPjHsuEFI7nCpwWhvtNPvxLvTiOJL9n3Cvh:2vjzRgP539JV0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2172	2480	rundll32.exe	30
PID 2480 wrote to memory of 2172	2480	rundll32.exe	30
PID 2480 wrote to memory of 2172	2480	rundll32.exe	30
PID 2480 wrote to memory of 2172	2480	rundll32.exe	30
PID 2480 wrote to memory of 2172	2480	rundll32.exe	30
PID 2480 wrote to memory of 2172	2480	rundll32.exe	30
PID 2480 wrote to memory of 2172	2480	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bd3cfce4337fedece6179cc35a0f0fe_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bd3cfce4337fedece6179cc35a0f0fe_JaffaCakes118.dll,#1
  2⤵
  PID:2172

memory/2172-0-0x0000000010000000-0x00000000100A2000-memory.dmp

Filesize
648KB

Download
memory/2172-2-0x0000000010000000-0x00000000100A2000-memory.dmp

Filesize
648KB

Download
memory/2172-1-0x0000000010000000-0x00000000100A2000-memory.dmp

Filesize
648KB

Download