369a7621b687e24d705fce47644628f8348b143064a35f9438dfcdb6c16b7af9

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 03:49

Target

40147b611a5a388f68f0aeeed5d9c6ac_JaffaCakes118.dll
Size

72KB
MD5

40147b611a5a388f68f0aeeed5d9c6ac
SHA1

18f30eca28b43c3cdf69cd299e03763642d6702f
SHA256

369a7621b687e24d705fce47644628f8348b143064a35f9438dfcdb6c16b7af9
SHA512

e223873f2659a141f20c51ecb2196eac2dceacf712f5d7838828ef74a5a7d2ec24df6ddc464111e2e0614c5a8715fb4ce6197e50044bcfe2f0794eba4cd9bbdd
SSDEEP

1536:IykzkagCsf/E+e3tbAPer8m+gXfJvrL8f7tUJcyCv8YvJoj:IFzkaF3+mfJv8pUGyCvbxoj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2700	2724	rundll32.exe	30
PID 2724 wrote to memory of 2700	2724	rundll32.exe	30
PID 2724 wrote to memory of 2700	2724	rundll32.exe	30
PID 2724 wrote to memory of 2700	2724	rundll32.exe	30
PID 2724 wrote to memory of 2700	2724	rundll32.exe	30
PID 2724 wrote to memory of 2700	2724	rundll32.exe	30
PID 2724 wrote to memory of 2700	2724	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40147b611a5a388f68f0aeeed5d9c6ac_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40147b611a5a388f68f0aeeed5d9c6ac_JaffaCakes118.dll,#1
  2⤵
  PID:2700

memory/2700-3-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2700-2-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2700-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2700-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download