dab19ac2df23564c29e832358cb7cae2a6979f171b87243619871fe4400ee2d3

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 18:04

Target

3e55c36e533925ee0f09aae2198ecbf0_JaffaCakes118.dll
Size

757KB
MD5

3e55c36e533925ee0f09aae2198ecbf0
SHA1

fb5faddd40af8886e91593a44bedda08532d71c7
SHA256

dab19ac2df23564c29e832358cb7cae2a6979f171b87243619871fe4400ee2d3
SHA512

643429f9a9849fb02367aa8d292791fabea2e296adba9bb87893b1d89ddbf3efd8de3cbbf0d4ebca4ab16960a621dd84079003ccb6a46f7464f35f75d3df2e17
SSDEEP

192:musClZr/XUL8/wrAbJzO5no/ndQT03pszVnkJoD9bsh4jzsNhsPypHBJKIg1CG3C:tsC8QgANGQT4kmDRTi2mBJKIp5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e55c36e533925ee0f09aae2198ecbf0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e55c36e533925ee0f09aae2198ecbf0_JaffaCakes118.dll,#1
  2⤵
  PID:1916

memory/1916-0-0x0000000020000000-0x0000000020008000-memory.dmp

Filesize
32KB

Download