d70105b2a3136978acd055f50b2e150146508dd135e9f585b188f7b0882f3529

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 12:07

Target

3d511651a454dd7fc4b5e4de36262865_JaffaCakes118.dll
Size

178KB
MD5

3d511651a454dd7fc4b5e4de36262865
SHA1

7efc6bf0e2d5823010b7964dbf44134d18e10aa7
SHA256

d70105b2a3136978acd055f50b2e150146508dd135e9f585b188f7b0882f3529
SHA512

df920976a5a7ebf4c794bb9b471b0f3641cd51bc9db0d1c3f2793f9221b906dff4996f8b64928181e45b67d861c892f12f3b17d44b4eb75a1549ad7c27876e61
SSDEEP

3072:+40NNmgZF+0kgXsrgPDvcDI01vV6b5+pHJl6R8dOMx1uLIkQtDkmHyfZBUNZ7oaM:t0Nk0+0vXskrcDI496bY5L6R8QMxYsBK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2380	2552	rundll32.exe	30
PID 2552 wrote to memory of 2380	2552	rundll32.exe	30
PID 2552 wrote to memory of 2380	2552	rundll32.exe	30
PID 2552 wrote to memory of 2380	2552	rundll32.exe	30
PID 2552 wrote to memory of 2380	2552	rundll32.exe	30
PID 2552 wrote to memory of 2380	2552	rundll32.exe	30
PID 2552 wrote to memory of 2380	2552	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d511651a454dd7fc4b5e4de36262865_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d511651a454dd7fc4b5e4de36262865_JaffaCakes118.dll,#1
  2⤵
  PID:2380

memory/2380-0-0x00000000001D0000-0x00000000001E9000-memory.dmp

Filesize
100KB

Download
memory/2380-1-0x0000000010000000-0x000000001005D000-memory.dmp

Filesize
372KB

Download