2e2a70dc7916a2bdc931ebe10262f7d205e64ed96925edea4b1d025bffb0044c

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 14:58

Target

3dd73d8ffbddaaa868993955db9a63dc_JaffaCakes118.dll
Size

306KB
MD5

3dd73d8ffbddaaa868993955db9a63dc
SHA1

173d98e991fcd62689be1b539f8a3709018356d7
SHA256

2e2a70dc7916a2bdc931ebe10262f7d205e64ed96925edea4b1d025bffb0044c
SHA512

d236899b6ff4c3fe918302f3dbe95fd63288fbf382e5da09214bef68fb178037d6377acd379ebe89b710bb0516a61ec7979350fe170eed9e74adf031a17f5126
SSDEEP

6144:ZNaJUwPN7wo+wy8aZnWPs4LaTEX5KAxhRAlwrhpqaEEcnp1wnO+ySr++siMSx8vl:LONcoukPDLzXfXrPhmp1wnO+yS/siIjB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3004	2988	rundll32.exe	31
PID 2988 wrote to memory of 3004	2988	rundll32.exe	31
PID 2988 wrote to memory of 3004	2988	rundll32.exe	31
PID 2988 wrote to memory of 3004	2988	rundll32.exe	31
PID 2988 wrote to memory of 3004	2988	rundll32.exe	31
PID 2988 wrote to memory of 3004	2988	rundll32.exe	31
PID 2988 wrote to memory of 3004	2988	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd73d8ffbddaaa868993955db9a63dc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd73d8ffbddaaa868993955db9a63dc_JaffaCakes118.dll,#1
  2⤵
  PID:3004

memory/3004-1-0x0000000010000000-0x00000000100A1000-memory.dmp

Filesize
644KB

Download
memory/3004-0-0x0000000010000000-0x00000000100A1000-memory.dmp

Filesize
644KB

Download
memory/3004-2-0x0000000010000000-0x00000000100A1000-memory.dmp

Filesize
644KB

Download