3f55c4f1d5cdc3591b1546231e93e8ae3b4587e3c55c7d1f3786a20f54d9aafb

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 13:09

Target

41cdf3404ce9ac555953fa1287c81a9b_JaffaCakes118.dll
Size

22KB
MD5

41cdf3404ce9ac555953fa1287c81a9b
SHA1

55ba0c820ebc4fd4eb66e85c44a35fe55f4a8a4e
SHA256

3f55c4f1d5cdc3591b1546231e93e8ae3b4587e3c55c7d1f3786a20f54d9aafb
SHA512

3242ae0464dd3b03d65e9531bebc5c7687d7b89273ba0421d4f9f380dc9d5f19b6193324605a850a1a6d1cfd813442ecd2dc975bcc6e6733f65f25660e598c9a
SSDEEP

384:fzvQeo/3/ujvi6VB18OqrurUEb8KE9sWQmTPchXFLScQwt:fzXoWjvt18281sWnTPcHLScB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1852	1292	rundll32.exe	29
PID 1292 wrote to memory of 1852	1292	rundll32.exe	29
PID 1292 wrote to memory of 1852	1292	rundll32.exe	29
PID 1292 wrote to memory of 1852	1292	rundll32.exe	29
PID 1292 wrote to memory of 1852	1292	rundll32.exe	29
PID 1292 wrote to memory of 1852	1292	rundll32.exe	29
PID 1292 wrote to memory of 1852	1292	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41cdf3404ce9ac555953fa1287c81a9b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41cdf3404ce9ac555953fa1287c81a9b_JaffaCakes118.dll,#1
  2⤵
  PID:1852

memory/1852-1-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1852-2-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1852-0-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download