79230186541689ad4791af62ddee792422f34632adffaace3252503ec12a692e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 21:21

Target

4b74671b5060da7eb2996a5760ec6e8b_JaffaCakes118.dll
Size

330KB
MD5

4b74671b5060da7eb2996a5760ec6e8b
SHA1

8d20ebda8ce4d2bd5db08746846f6824728daf78
SHA256

79230186541689ad4791af62ddee792422f34632adffaace3252503ec12a692e
SHA512

f020903292b54fb289e9f59a7f6dd2f3b4b01da6259e7ceb1176afba13b684fbff1a7abd09fd4f246483094e8242afd7f91302c51a529e7c606667578acca270
SSDEEP

6144:6apMONNZ34us8xFPIGXJZf48YYLeWKd29Yg8m9Hz7V0:6iMaIKXo8YYCWKd29Yg8m9u

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2280	2520	rundll32.exe	30
PID 2520 wrote to memory of 2280	2520	rundll32.exe	30
PID 2520 wrote to memory of 2280	2520	rundll32.exe	30
PID 2520 wrote to memory of 2280	2520	rundll32.exe	30
PID 2520 wrote to memory of 2280	2520	rundll32.exe	30
PID 2520 wrote to memory of 2280	2520	rundll32.exe	30
PID 2520 wrote to memory of 2280	2520	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b74671b5060da7eb2996a5760ec6e8b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b74671b5060da7eb2996a5760ec6e8b_JaffaCakes118.dll,#1
  2⤵
  PID:2280

memory/2280-0-0x0000000010000000-0x00000000100A3000-memory.dmp

Filesize
652KB

Download
memory/2280-1-0x0000000010000000-0x00000000100A3000-memory.dmp

Filesize
652KB

Download