3e096132384c1e300f2ca14fd197d82b926edaa9c8dd4a6c077ff9c41909bdb6

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 03:49

Target

401457320f5474e84dc77a4064d2ae00_JaffaCakes118.dll
Size

183KB
MD5

401457320f5474e84dc77a4064d2ae00
SHA1

30cbc96cc051ba6023dbd11fb527b2346eacc704
SHA256

3e096132384c1e300f2ca14fd197d82b926edaa9c8dd4a6c077ff9c41909bdb6
SHA512

56b2a3b14b7ed3d69d68a571a99563635cc38626022ea37de22508694284724fa306f5d992901ef52cc539b47aa38db9447bbdee0578c2ea27596408d57aff59
SSDEEP

3072:K6/mFBrP2/E+7mslheiHsI/U+owztYcegkZq9lz7VOfy+1iVyEdQlK5z:f/YoE+a6hgiU+dOgaq9lz7VdPyEdbt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 1348	2408	rundll32.exe	28
PID 2408 wrote to memory of 1348	2408	rundll32.exe	28
PID 2408 wrote to memory of 1348	2408	rundll32.exe	28
PID 2408 wrote to memory of 1348	2408	rundll32.exe	28
PID 2408 wrote to memory of 1348	2408	rundll32.exe	28
PID 2408 wrote to memory of 1348	2408	rundll32.exe	28
PID 2408 wrote to memory of 1348	2408	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\401457320f5474e84dc77a4064d2ae00_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\401457320f5474e84dc77a4064d2ae00_JaffaCakes118.dll,#1
  2⤵
  PID:1348

memory/1348-0-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1348-3-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download
memory/1348-2-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1348-1-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download