359e46eafb3f30f10970f0e9be68dcf6bce297824a9541ff58803403fc7a81ca

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 02:27

Target

43ee947df2ce66f2de8fa46b38ff0087_JaffaCakes118.dll
Size

306KB
MD5

43ee947df2ce66f2de8fa46b38ff0087
SHA1

1e8887f5f8cca17297199aa0bbc5b967450cbb64
SHA256

359e46eafb3f30f10970f0e9be68dcf6bce297824a9541ff58803403fc7a81ca
SHA512

873506f6514a84360adde1a8dc94571957be3525edec81bd0de0e552002f899c7185d9c775cdf8e3fc56a84bf1f7787ffbe99513c0fe3c8f5d392ec1daf9cbda
SSDEEP

6144:kF780wFnjdJDPCz+70tReopfjQhhV2UEmhC1XooqrBqROXZ4tCkFEAa2b3dmRyYw:7ROhH5qhVjheXTqrBcOXKFFEV2b3bYw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 1128	2568	rundll32.exe	30
PID 2568 wrote to memory of 1128	2568	rundll32.exe	30
PID 2568 wrote to memory of 1128	2568	rundll32.exe	30
PID 2568 wrote to memory of 1128	2568	rundll32.exe	30
PID 2568 wrote to memory of 1128	2568	rundll32.exe	30
PID 2568 wrote to memory of 1128	2568	rundll32.exe	30
PID 2568 wrote to memory of 1128	2568	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43ee947df2ce66f2de8fa46b38ff0087_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\43ee947df2ce66f2de8fa46b38ff0087_JaffaCakes118.dll,#1
  2⤵
  PID:1128

memory/1128-0-0x0000000010000000-0x00000000100A0000-memory.dmp

Filesize
640KB

Download
memory/1128-2-0x0000000010000000-0x00000000100A0000-memory.dmp

Filesize
640KB

Download
memory/1128-1-0x0000000010000000-0x00000000100A0000-memory.dmp

Filesize
640KB

Download