3b15eb41bb9bd2eba8635b14743230b7a63d23b4a15271744e60b109e134e2d2

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 14:41

Target

421b5a50d7a5278c72474d7b4da7ad79_JaffaCakes118.dll
Size

81KB
MD5

421b5a50d7a5278c72474d7b4da7ad79
SHA1

9331519f92dc7fe6b7ff4cc25a7f036230292cd2
SHA256

3b15eb41bb9bd2eba8635b14743230b7a63d23b4a15271744e60b109e134e2d2
SHA512

715dab1e9efd6170c68c2876cf3ec7e418af5f644864e742baee3ff7630fea4159d1e4d439ce2e90cd42a11528a4d698af8fc92ae63af5064814ab848dbbdd8d
SSDEEP

1536:V8O9Nn6RjrijyB5RakNebCsWnaVLas8kMywroQJPbmlKepf+wCYryz0d/byTY55Y:2Oz6VW2B5lsVL/8kMImP4fqYryz0dOc0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2944	3008	rundll32.exe	30
PID 3008 wrote to memory of 2944	3008	rundll32.exe	30
PID 3008 wrote to memory of 2944	3008	rundll32.exe	30
PID 3008 wrote to memory of 2944	3008	rundll32.exe	30
PID 3008 wrote to memory of 2944	3008	rundll32.exe	30
PID 3008 wrote to memory of 2944	3008	rundll32.exe	30
PID 3008 wrote to memory of 2944	3008	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\421b5a50d7a5278c72474d7b4da7ad79_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\421b5a50d7a5278c72474d7b4da7ad79_JaffaCakes118.dll,#1
  2⤵
  PID:2944

memory/2944-3-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2944-2-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2944-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2944-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download