f212c0f4a2b779de34359c03e293503534c8c849257ac96c9ff17af67b3c4407

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 03:48

Target

3be23c3d15a4ea26d2638ebf56fd836f_JaffaCakes118.dll
Size

125KB
MD5

3be23c3d15a4ea26d2638ebf56fd836f
SHA1

b19ca38cc37aca82861350516eed1283652ebed1
SHA256

f212c0f4a2b779de34359c03e293503534c8c849257ac96c9ff17af67b3c4407
SHA512

b516ead9c89b40bc77b714cee068b70ad08b3b1009c5425c15db090a4578ec35a403467028b849ebb703e42ce9141b979bf5f67f77e70bf33d0caa7b29f856eb
SSDEEP

1536:PBsPoYippdVeL4J9tCM8dQRrb9DD4uCZaXGUvEOnt9FtcbVl56H+lropE6JC4PKM:PCPQpxJ9tLxFnFfp+EEQC4Pn/AaPR0o

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1940	1772	rundll32.exe	30
PID 1772 wrote to memory of 1940	1772	rundll32.exe	30
PID 1772 wrote to memory of 1940	1772	rundll32.exe	30
PID 1772 wrote to memory of 1940	1772	rundll32.exe	30
PID 1772 wrote to memory of 1940	1772	rundll32.exe	30
PID 1772 wrote to memory of 1940	1772	rundll32.exe	30
PID 1772 wrote to memory of 1940	1772	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3be23c3d15a4ea26d2638ebf56fd836f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3be23c3d15a4ea26d2638ebf56fd836f_JaffaCakes118.dll,#1
  2⤵
  PID:1940

memory/1940-1-0x00000000001F0000-0x0000000000210000-memory.dmp

Filesize
128KB

Download
memory/1940-2-0x00000000001F0000-0x0000000000210000-memory.dmp

Filesize
128KB

Download
memory/1940-0-0x00000000001F0000-0x0000000000210000-memory.dmp

Filesize
128KB

Download
memory/1940-3-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download