c9ac3d10cc4e5450b39e3a2da3d5181d219ba61719b320621755b0d1155a44c9

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 03:13

Target

3ff6e19fbb17ea6e92f81eb8ba77a0de_JaffaCakes118.dll
Size

101KB
MD5

3ff6e19fbb17ea6e92f81eb8ba77a0de
SHA1

f772ca13109826bec85d3ec91a7cd82d5c578b17
SHA256

c9ac3d10cc4e5450b39e3a2da3d5181d219ba61719b320621755b0d1155a44c9
SHA512

0936bfe9ca4798161efe0cbc66dbdfc4320bc28bf4019acd70da0ad650d4026e6d2c3850876330618faf240c0d89716d2ad39ffdcc087d4fd713942052febb32
SSDEEP

1536:fAPRrQ3xawGfOcnJxn8R6z4BjucXrvrcJ:fwRiIwFWJx8g0BdcJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 1696	2484	rundll32.exe	30
PID 2484 wrote to memory of 1696	2484	rundll32.exe	30
PID 2484 wrote to memory of 1696	2484	rundll32.exe	30
PID 2484 wrote to memory of 1696	2484	rundll32.exe	30
PID 2484 wrote to memory of 1696	2484	rundll32.exe	30
PID 2484 wrote to memory of 1696	2484	rundll32.exe	30
PID 2484 wrote to memory of 1696	2484	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ff6e19fbb17ea6e92f81eb8ba77a0de_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ff6e19fbb17ea6e92f81eb8ba77a0de_JaffaCakes118.dll,#1
  2⤵
  PID:1696

memory/1696-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download