e382d63ba9d1c47598075687fe29063e329af355ece7cb211c8a242977e89008

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 05:14

Target

4053339d186dc2c8894efdf150e79782_JaffaCakes118.dll
Size

179KB
MD5

4053339d186dc2c8894efdf150e79782
SHA1

2e1d589cc73265b0a98cf18395dafada3cabed41
SHA256

e382d63ba9d1c47598075687fe29063e329af355ece7cb211c8a242977e89008
SHA512

12417d2bb297bd125849aa08f6dfd4e9e34ee42700d069ef386e8be987dbfab0f1a7b9dc3408ba7c2c120905c9f8aebef073fbba98447bfaf1f9cbaadabfb3a4
SSDEEP

1536:0mHWD0moPF9z6hBbRF7bI2yvyQxEkepabITjSBdtBTLrms15:0mHWD4PvmR62dQq4Bdtx/ms15

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2184	2284	rundll32.exe	30
PID 2284 wrote to memory of 2184	2284	rundll32.exe	30
PID 2284 wrote to memory of 2184	2284	rundll32.exe	30
PID 2284 wrote to memory of 2184	2284	rundll32.exe	30
PID 2284 wrote to memory of 2184	2284	rundll32.exe	30
PID 2284 wrote to memory of 2184	2284	rundll32.exe	30
PID 2284 wrote to memory of 2184	2284	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4053339d186dc2c8894efdf150e79782_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4053339d186dc2c8894efdf150e79782_JaffaCakes118.dll,#1
  2⤵
  PID:2184

memory/2184-1-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2184-3-0x0000000000433000-0x0000000000434000-memory.dmp

Filesize
4KB

Download
memory/2184-2-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2184-0-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download