c133fd452ae321632c6d9cc47cab63c452f6fd5b4072492af87b1b8ac1e1723a

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 09:57

Target

3ce8b33adf1d74e61d6285d57d1be51f_JaffaCakes118.dll
Size

27KB
MD5

3ce8b33adf1d74e61d6285d57d1be51f
SHA1

69d22ca5e34a67222858950ec47fde13f2e5ce0a
SHA256

c133fd452ae321632c6d9cc47cab63c452f6fd5b4072492af87b1b8ac1e1723a
SHA512

bac1f7cf7f56eb669650420aead77911be2d969cfa99860f3c90ea5ee6e7dfefffd5faca2bddb08624079447ae4e58322ae9550c61597a006494d130a96c3920
SSDEEP

768:V2Fkt5mrbHxQP8V0ptNBGkpylM6bEAVYXlX:V2Fkr660V0fNBZAPEA8lX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 1964	904	rundll32.exe	30
PID 904 wrote to memory of 1964	904	rundll32.exe	30
PID 904 wrote to memory of 1964	904	rundll32.exe	30
PID 904 wrote to memory of 1964	904	rundll32.exe	30
PID 904 wrote to memory of 1964	904	rundll32.exe	30
PID 904 wrote to memory of 1964	904	rundll32.exe	30
PID 904 wrote to memory of 1964	904	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ce8b33adf1d74e61d6285d57d1be51f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ce8b33adf1d74e61d6285d57d1be51f_JaffaCakes118.dll,#1
  2⤵
  PID:1964

memory/1964-0-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/1964-1-0x0000000010017000-0x0000000010018000-memory.dmp

Filesize
4KB

Download
memory/1964-2-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download