d76b855ff48d1553ec5ce429603e306ae19699373d80d2fcba7f9eecfa127fd9

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 04:10

Target

3beffdc3d99d8d29c009e50c24580eac_JaffaCakes118.dll
Size

36KB
MD5

3beffdc3d99d8d29c009e50c24580eac
SHA1

b813ef675965fbe810c5eb241091d76a7e655bb0
SHA256

d76b855ff48d1553ec5ce429603e306ae19699373d80d2fcba7f9eecfa127fd9
SHA512

bd4ae264c5a2f0ada149a0680d601ec18bd1e78b614191314755528f791016b49f5d3e3dd762d7d77f85991451d4a5b9ff06541f6046d35586dab7f90332a0c4
SSDEEP

768:P1jT7mkOoqXa88lhAQ0+TAs+Ckw3UAr5AB9aDG9BKipipGH8:P1jyoqq88yI+CDP6jkGiX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2416	1628	rundll32.exe	28
PID 1628 wrote to memory of 2416	1628	rundll32.exe	28
PID 1628 wrote to memory of 2416	1628	rundll32.exe	28
PID 1628 wrote to memory of 2416	1628	rundll32.exe	28
PID 1628 wrote to memory of 2416	1628	rundll32.exe	28
PID 1628 wrote to memory of 2416	1628	rundll32.exe	28
PID 1628 wrote to memory of 2416	1628	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3beffdc3d99d8d29c009e50c24580eac_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3beffdc3d99d8d29c009e50c24580eac_JaffaCakes118.dll,#1
  2⤵
  PID:2416

memory/2416-4-0x0000000000170000-0x0000000000175000-memory.dmp

Filesize
20KB

Download
memory/2416-3-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2416-2-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2416-1-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2416-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download