24abb43d028711fda01bc59c13fd0b4c6c65ad04e2541dfed0de2198f21d9c06

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 02:44

Target

43fa44a9460120279a77ea71039f84bb_JaffaCakes118.dll
Size

139KB
MD5

43fa44a9460120279a77ea71039f84bb
SHA1

e776749d4d576aca8bde294b09e60239b0cd736b
SHA256

24abb43d028711fda01bc59c13fd0b4c6c65ad04e2541dfed0de2198f21d9c06
SHA512

a82534f2eb104f49807f2ff71f655ff0c4cb8734847d322031e2caa30e2ad52cbbea80d876ed97ee4c02203bd066e19b9c8d949cdac400ebb807caae8211b627
SSDEEP

3072:+VO5iWRvZmxA2+dHHcxG1vsBXVPPwe6T/nx1MP:+0FZ+dG1ULwe6Tf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2844	2676	rundll32.exe	30
PID 2676 wrote to memory of 2844	2676	rundll32.exe	30
PID 2676 wrote to memory of 2844	2676	rundll32.exe	30
PID 2676 wrote to memory of 2844	2676	rundll32.exe	30
PID 2676 wrote to memory of 2844	2676	rundll32.exe	30
PID 2676 wrote to memory of 2844	2676	rundll32.exe	30
PID 2676 wrote to memory of 2844	2676	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43fa44a9460120279a77ea71039f84bb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\43fa44a9460120279a77ea71039f84bb_JaffaCakes118.dll,#1
  2⤵
  PID:2844

memory/2844-1-0x0000000054C60000-0x0000000054C86000-memory.dmp

Filesize
152KB

Download
memory/2844-0-0x0000000054C60000-0x0000000054C86000-memory.dmp

Filesize
152KB

Download