762d532e066c7676be42d029a09529f2f5b0d04be3ef3cda003d3d13d3e4de5e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 07:37

Target

44e4cca7588b10da1f4b86143b98aa39_JaffaCakes118.dll
Size

862KB
MD5

44e4cca7588b10da1f4b86143b98aa39
SHA1

9204d8796d38ce9ff8fec1d70f3368f38c0141ee
SHA256

762d532e066c7676be42d029a09529f2f5b0d04be3ef3cda003d3d13d3e4de5e
SHA512

9623bd20baf5e1eb1f052e02208e9f0d88d633cbf64b54d532780479674b7abd8d10dbee251c916e1cf05ecc8d222fbfff50ef85722c218e18788d2a5228012e
SSDEEP

24576:aCaIoN2YZ31DatgwVgEvVNyrSsIfSX8fGWi9tZ:aCaIoN2ms2whvVwOo8fytZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2696	2660	rundll32.exe	31
PID 2660 wrote to memory of 2696	2660	rundll32.exe	31
PID 2660 wrote to memory of 2696	2660	rundll32.exe	31
PID 2660 wrote to memory of 2696	2660	rundll32.exe	31
PID 2660 wrote to memory of 2696	2660	rundll32.exe	31
PID 2660 wrote to memory of 2696	2660	rundll32.exe	31
PID 2660 wrote to memory of 2696	2660	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44e4cca7588b10da1f4b86143b98aa39_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44e4cca7588b10da1f4b86143b98aa39_JaffaCakes118.dll,#1
  2⤵
  PID:2696

memory/2696-0-0x0000000001F70000-0x0000000002076000-memory.dmp

Filesize
1.0MB

Download
memory/2696-1-0x0000000001F78000-0x0000000001F79000-memory.dmp

Filesize
4KB

Download
memory/2696-2-0x0000000001F70000-0x0000000002076000-memory.dmp

Filesize
1.0MB

Download