31b6f5c16c33680a547264af71a54453ff0576316b22b495eb9a389c7e62f03c

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 04:24

Target

402f4d6e0f73527cd627f20d102edd46_JaffaCakes118.dll
Size

159KB
MD5

402f4d6e0f73527cd627f20d102edd46
SHA1

1451c7b2aae1da334a3b4176aa1e88159eaeccf4
SHA256

31b6f5c16c33680a547264af71a54453ff0576316b22b495eb9a389c7e62f03c
SHA512

c36587e92c7222ab6775a63d5cd958a6f5b546025229582aad2b8dee34bea04d9516c4999c75f843c1911348938c054ec15f4d7e96816650cbac0efe66f46bcc
SSDEEP

3072:WjudcJRoSitAPkD6c2FfL26HQnZ3gXk23s5Pa+jB3fwLEx:YUcJwL2FfL3yJaU3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2360	2088	rundll32.exe	31
PID 2088 wrote to memory of 2360	2088	rundll32.exe	31
PID 2088 wrote to memory of 2360	2088	rundll32.exe	31
PID 2088 wrote to memory of 2360	2088	rundll32.exe	31
PID 2088 wrote to memory of 2360	2088	rundll32.exe	31
PID 2088 wrote to memory of 2360	2088	rundll32.exe	31
PID 2088 wrote to memory of 2360	2088	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\402f4d6e0f73527cd627f20d102edd46_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\402f4d6e0f73527cd627f20d102edd46_JaffaCakes118.dll,#1
  2⤵
  PID:2360

memory/2360-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2360-1-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download