0b214657b42f8350d26ef635c7e85415c90b18a98df9af409915ac16ff4da88b

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 04:50

Target

40446f3e59533c0acc678ee0011789b3_JaffaCakes118.dll
Size

231KB
MD5

40446f3e59533c0acc678ee0011789b3
SHA1

6c2a0da274380897000947d46f91f77d1092868e
SHA256

0b214657b42f8350d26ef635c7e85415c90b18a98df9af409915ac16ff4da88b
SHA512

cdc64bd655af327fae4493b07afd256fe9cb3f873924f476d194c20dbe694cca12da55fe61396b9af183857e1fbfe51486bc5c62c664c4dac986cb9db5f7e789
SSDEEP

6144:T/Jp9h4DsfBZU1PgsWvYfkamQioAAJjGZHgyq1u:rthssfBZUPbYXANGZjN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2980	1948	rundll32.exe	30
PID 1948 wrote to memory of 2980	1948	rundll32.exe	30
PID 1948 wrote to memory of 2980	1948	rundll32.exe	30
PID 1948 wrote to memory of 2980	1948	rundll32.exe	30
PID 1948 wrote to memory of 2980	1948	rundll32.exe	30
PID 1948 wrote to memory of 2980	1948	rundll32.exe	30
PID 1948 wrote to memory of 2980	1948	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40446f3e59533c0acc678ee0011789b3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40446f3e59533c0acc678ee0011789b3_JaffaCakes118.dll,#1
  2⤵
  PID:2980

memory/2980-0-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/2980-2-0x0000000000160000-0x0000000000199000-memory.dmp

Filesize
228KB

Download
memory/2980-1-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download