264464b7effb3de122e82c752b8232a67252c91ba891f740d39288f42bf0bfd2

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 20:41

Target

43434ac71dfc442f2a481062cfa8bc85_JaffaCakes118.dll
Size

78KB
MD5

43434ac71dfc442f2a481062cfa8bc85
SHA1

30f6733c02386c5a8f127dfa2f6c7739b4e5eacf
SHA256

264464b7effb3de122e82c752b8232a67252c91ba891f740d39288f42bf0bfd2
SHA512

a7544cc263a3d81b05cd6efe98e198d7d7fa78dc12f7a1015e71708687aadef4801953c213cc7bb0588b1d3e60866e4ec577c2b3497b027b1e5ebf3bffaf35a5
SSDEEP

1536:Iykzkagwv29ZaOiiVEXQJP2eHdWGVX90Bb9fRurNs/p0N2:IFzkaD29ZaOiiVmPeHIoXGBxwrNeh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2572	2288	rundll32.exe	31
PID 2288 wrote to memory of 2572	2288	rundll32.exe	31
PID 2288 wrote to memory of 2572	2288	rundll32.exe	31
PID 2288 wrote to memory of 2572	2288	rundll32.exe	31
PID 2288 wrote to memory of 2572	2288	rundll32.exe	31
PID 2288 wrote to memory of 2572	2288	rundll32.exe	31
PID 2288 wrote to memory of 2572	2288	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43434ac71dfc442f2a481062cfa8bc85_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\43434ac71dfc442f2a481062cfa8bc85_JaffaCakes118.dll,#1
  2⤵
  PID:2572

memory/2572-3-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2572-2-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2572-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2572-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download