b9aa193cb889d5b91a0da706737e7bd2b1d87228de4e77fe50836a41aa7d4e18

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 04:35

Target

3c00bc0343dc19c6f0a152d039bc2e8b_JaffaCakes118.dll
Size

43KB
MD5

3c00bc0343dc19c6f0a152d039bc2e8b
SHA1

8766e2a69157f8120ec7bac484029f37654877bc
SHA256

b9aa193cb889d5b91a0da706737e7bd2b1d87228de4e77fe50836a41aa7d4e18
SHA512

9bfb260d9e1b24fdd20333d91b2a077c96928ea2306f83f0a41a4f575a86b768d970b6fb606d1c170f123e5fb13fbb8f8c6e231a8859838638a3678e6bc6ffc8
SSDEEP

768:CQ1RnoE8dwDK9DIR6WS6nKDDsfsNw4GnhdV9o4l:CwSKhfKvo75V9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 112	2368	rundll32.exe	29
PID 2368 wrote to memory of 112	2368	rundll32.exe	29
PID 2368 wrote to memory of 112	2368	rundll32.exe	29
PID 2368 wrote to memory of 112	2368	rundll32.exe	29
PID 2368 wrote to memory of 112	2368	rundll32.exe	29
PID 2368 wrote to memory of 112	2368	rundll32.exe	29
PID 2368 wrote to memory of 112	2368	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c00bc0343dc19c6f0a152d039bc2e8b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c00bc0343dc19c6f0a152d039bc2e8b_JaffaCakes118.dll,#1
  2⤵
  PID:112

memory/112-2-0x00000000002B0000-0x0000000000387000-memory.dmp

Filesize
860KB

Download
memory/112-1-0x00000000002B7000-0x00000000002B9000-memory.dmp

Filesize
8KB

Download
memory/112-0-0x00000000002B0000-0x0000000000387000-memory.dmp

Filesize
860KB

Download
memory/112-3-0x00000000002B0000-0x0000000000387000-memory.dmp

Filesize
860KB

Download