a2b9c4c3c3a960f1e3610224c3a72c41c0c214c371081c269beed3d4bbfc52a7

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 06:00

Target

4499fc3d67b59362a7f5c11960ba5c63_JaffaCakes118.dll
Size

167KB
MD5

4499fc3d67b59362a7f5c11960ba5c63
SHA1

480647158af40dc6fae22523bc63563b48938ee0
SHA256

a2b9c4c3c3a960f1e3610224c3a72c41c0c214c371081c269beed3d4bbfc52a7
SHA512

11cf72908d036297f89d38dc902dea1e2a542954501fead6989f8019f9fb427e6f6c39c66afe34ffa436602090494aead0801c6e87fa257e9cf9662e47a9f696
SSDEEP

3072:cuzKPUNhkuM7LNpU+5hdLk7ydfdlxTxgr+rKqld3TyBTsaCIsB9VI7dOeDWu:cuzFhkuQ3UmhdLou19g0KqfyTsaCo7Aq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1720	1528	rundll32.exe	30
PID 1528 wrote to memory of 1720	1528	rundll32.exe	30
PID 1528 wrote to memory of 1720	1528	rundll32.exe	30
PID 1528 wrote to memory of 1720	1528	rundll32.exe	30
PID 1528 wrote to memory of 1720	1528	rundll32.exe	30
PID 1528 wrote to memory of 1720	1528	rundll32.exe	30
PID 1528 wrote to memory of 1720	1528	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4499fc3d67b59362a7f5c11960ba5c63_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4499fc3d67b59362a7f5c11960ba5c63_JaffaCakes118.dll,#1
  2⤵
  PID:1720

memory/1720-1-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/1720-0-0x00000000001B0000-0x00000000001D5000-memory.dmp

Filesize
148KB

Download