a1996da6494787b3fbd6f9bb8b06a86bd822e62656ca7ded0197972e427a3e46

Analysis

max time kernel
11s
max time network
15s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 12:15

Target

3d566c5eb497791e4cd581df71183ffb_JaffaCakes118.dll
Size

2.2MB
MD5

3d566c5eb497791e4cd581df71183ffb
SHA1

b63d751d2a1981ca2746955ee557815ef4eb2afc
SHA256

a1996da6494787b3fbd6f9bb8b06a86bd822e62656ca7ded0197972e427a3e46
SHA512

390a30c65c205fa9468565c8da1ce80725ab569fb3d19050544cca260ffd8515d567ac80f79a3de42c166509ec956423d189c582445628c02595f9d3f4d1fec7
SSDEEP

49152:hu2XG8ZoI9Z9rqyI44HppuzGxHHY4L2q5HkL+eUYWHsiJNXvkUr:JWGoqZ92yVG/uzGNV9HkAVHL/Dr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2536	2520	rundll32.exe	30
PID 2520 wrote to memory of 2536	2520	rundll32.exe	30
PID 2520 wrote to memory of 2536	2520	rundll32.exe	30
PID 2520 wrote to memory of 2536	2520	rundll32.exe	30
PID 2520 wrote to memory of 2536	2520	rundll32.exe	30
PID 2520 wrote to memory of 2536	2520	rundll32.exe	30
PID 2520 wrote to memory of 2536	2520	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d566c5eb497791e4cd581df71183ffb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d566c5eb497791e4cd581df71183ffb_JaffaCakes118.dll,#1
  2⤵
  PID:2536

memory/2536-0-0x0000000010000000-0x000000001006C000-memory.dmp

Filesize
432KB

Download