df2282d49c1a38d8f8c8014f410dd826cb2058b58f2a1d7facaf7c3f0dbe6c8d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 18:58

Target

4afb540e10379a9560e4b12c21ba5aab_JaffaCakes118.dll
Size

100KB
MD5

4afb540e10379a9560e4b12c21ba5aab
SHA1

1015bdb8e0bd4996bf2a19a56ed13cd2e7bdcb66
SHA256

df2282d49c1a38d8f8c8014f410dd826cb2058b58f2a1d7facaf7c3f0dbe6c8d
SHA512

998ffee69206474ea71850e70b1ae0d6fa1288cfa60d54b8de92674696e9cd661fa15b4083ae293e80dbd7e38a2b0cb82125e7e7999f158ce56835fbf002c68f
SSDEEP

3072:WjNfX25uxLS7unH1x7LydCmNmd2chmsBYcuRi:W9m5uxH15UKDm8S

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2424	1940	rundll32.exe	30
PID 1940 wrote to memory of 2424	1940	rundll32.exe	30
PID 1940 wrote to memory of 2424	1940	rundll32.exe	30
PID 1940 wrote to memory of 2424	1940	rundll32.exe	30
PID 1940 wrote to memory of 2424	1940	rundll32.exe	30
PID 1940 wrote to memory of 2424	1940	rundll32.exe	30
PID 1940 wrote to memory of 2424	1940	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4afb540e10379a9560e4b12c21ba5aab_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4afb540e10379a9560e4b12c21ba5aab_JaffaCakes118.dll,#1
  2⤵
  PID:2424

memory/2424-1-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/2424-0-0x0000000010015000-0x0000000010028000-memory.dmp

Filesize
76KB

Download