3128cc01ac3b67456fb9cc2cd9052e6d17dcb989e7d9ed8326c51e332b88834f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 00:28

Target

43cecd48df2118cae90b8395751ffe67_JaffaCakes118.dll
Size

44KB
MD5

43cecd48df2118cae90b8395751ffe67
SHA1

872e262def17e879c48cfdeee2edbfdae215e1f5
SHA256

3128cc01ac3b67456fb9cc2cd9052e6d17dcb989e7d9ed8326c51e332b88834f
SHA512

9961e31563a2c0862102177c12d887c99b489ab76e8e6767f0a2b29f90a900f4bd3561deb9a6e41ae8857d8577612a21db116922270ab1f3b05887a1cd36864a
SSDEEP

768:iFl1FVrw7CfXQ4SVde2QKDuvqtNYUYmDHARv3MGD8/lc6:CnEtNf7DHo3MGY/l3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1796	1588	rundll32.exe	30
PID 1588 wrote to memory of 1796	1588	rundll32.exe	30
PID 1588 wrote to memory of 1796	1588	rundll32.exe	30
PID 1588 wrote to memory of 1796	1588	rundll32.exe	30
PID 1588 wrote to memory of 1796	1588	rundll32.exe	30
PID 1588 wrote to memory of 1796	1588	rundll32.exe	30
PID 1588 wrote to memory of 1796	1588	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43cecd48df2118cae90b8395751ffe67_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\43cecd48df2118cae90b8395751ffe67_JaffaCakes118.dll,#1
  2⤵
  PID:1796

memory/1796-0-0x000000000F190000-0x000000000F1A2000-memory.dmp

Filesize
72KB

Download