4454178c4fbd40fe211cb2badcf444d0fce16e19e8fa0ef8cbdfae0b53a6bfaf

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 00:20

Target

43c8aaa6125930329a5535caf17fd3dd_JaffaCakes118.dll
Size

502KB
MD5

43c8aaa6125930329a5535caf17fd3dd
SHA1

73c709565394d3f1b0bd77875b3151158a6e27b2
SHA256

4454178c4fbd40fe211cb2badcf444d0fce16e19e8fa0ef8cbdfae0b53a6bfaf
SHA512

3382cb8ee86c49f448457a4b7275508707dda30c1c9ab79c8285689ea89e50d6f658d97c9f8e3a20d8ed05fe20b20de25db80e3baa6c8803d8c6c8cffa525a2d
SSDEEP

12288:iqfSLawcU+D1NSau5cPNfVTluWyaj4H4tNfVCnPbMf:nfSLPqD182dKaztw2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2668	824	rundll32.exe	30
PID 824 wrote to memory of 2668	824	rundll32.exe	30
PID 824 wrote to memory of 2668	824	rundll32.exe	30
PID 824 wrote to memory of 2668	824	rundll32.exe	30
PID 824 wrote to memory of 2668	824	rundll32.exe	30
PID 824 wrote to memory of 2668	824	rundll32.exe	30
PID 824 wrote to memory of 2668	824	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43c8aaa6125930329a5535caf17fd3dd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\43c8aaa6125930329a5535caf17fd3dd_JaffaCakes118.dll,#1
  2⤵
  PID:2668

memory/2668-0-0x0000000010000000-0x00000000100A0000-memory.dmp

Filesize
640KB

Download
memory/2668-1-0x0000000010000000-0x00000000100A0000-memory.dmp

Filesize
640KB

Download