3ea307a213baf3806c33736a05c1e87dba95f554337b704e3e3c3f56affcccf2

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 12:54

Target

49ddd292d5843b1eba9ba133eadad9a0_JaffaCakes118.dll
Size

13KB
MD5

49ddd292d5843b1eba9ba133eadad9a0
SHA1

fadbb22acdf238d7547d095d853a123848e0b55f
SHA256

3ea307a213baf3806c33736a05c1e87dba95f554337b704e3e3c3f56affcccf2
SHA512

39d4cba18476e502aa74c7bfeebc04138a42a690087f1b9ef1519708969bb10ea30dfa33874fe75abdba6ca03a3e65e048c77f36738382aa09ccd443a11747d8
SSDEEP

384:nMSJlmRXLnGGyIUnJ0EzWy43fboc/lPSZhSCJICLa022VPVqgPs0d1yrrUMP4/93:FKn7Agn3x2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2280	2156	rundll32.exe	28
PID 2156 wrote to memory of 2280	2156	rundll32.exe	28
PID 2156 wrote to memory of 2280	2156	rundll32.exe	28
PID 2156 wrote to memory of 2280	2156	rundll32.exe	28
PID 2156 wrote to memory of 2280	2156	rundll32.exe	28
PID 2156 wrote to memory of 2280	2156	rundll32.exe	28
PID 2156 wrote to memory of 2280	2156	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\49ddd292d5843b1eba9ba133eadad9a0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\49ddd292d5843b1eba9ba133eadad9a0_JaffaCakes118.dll,#1
  2⤵
  PID:2280

memory/2280-0-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download