d9d8735af73d65ba1e7c62af95e2477b7abb57b44ce4d4062127a90890d9c581

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 12:57

Target

3d7796c94309c97e097be238b6cac404_JaffaCakes118.dll
Size

172KB
MD5

3d7796c94309c97e097be238b6cac404
SHA1

01ad18288660490e1c8bed748adb63a5ac27f7ff
SHA256

d9d8735af73d65ba1e7c62af95e2477b7abb57b44ce4d4062127a90890d9c581
SHA512

91c50762bc298c68a062d9faba07dc02b9c734c5cb6adad4ea5a55212ddfd969e004e776fd428e6e557a1d97f96f1690a24d6d6f77f86d7deade67b14909ecac
SSDEEP

3072:BmfVCyNYUv8FiGZmvKs7KoRjhRj80P5EmXYrXr2ZvV0:kfVPTvuiGZmvzKoRjr40PWmX8C

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 1692	2960	rundll32.exe	30
PID 2960 wrote to memory of 1692	2960	rundll32.exe	30
PID 2960 wrote to memory of 1692	2960	rundll32.exe	30
PID 2960 wrote to memory of 1692	2960	rundll32.exe	30
PID 2960 wrote to memory of 1692	2960	rundll32.exe	30
PID 2960 wrote to memory of 1692	2960	rundll32.exe	30
PID 2960 wrote to memory of 1692	2960	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d7796c94309c97e097be238b6cac404_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d7796c94309c97e097be238b6cac404_JaffaCakes118.dll,#1
  2⤵
  PID:1692

memory/1692-1-0x00000000001E0000-0x0000000000201000-memory.dmp

Filesize
132KB

Download
memory/1692-2-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/1692-3-0x0000000075330000-0x000000007533F000-memory.dmp

Filesize
60KB

Download