bd8385644c39526933f06f7201f763200063af3a3f9bd7b1f708a0fdb6c0c10b

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 10:06

Target

4dd71e2054401384d497ce8a7bc48568_JaffaCakes118.dll
Size

366KB
MD5

4dd71e2054401384d497ce8a7bc48568
SHA1

38059f0921ce84cd6e30fe72d4e3c90a0a8c63c8
SHA256

bd8385644c39526933f06f7201f763200063af3a3f9bd7b1f708a0fdb6c0c10b
SHA512

fd93e15ee3fdefc37a67d6b90e494a42739ad69ea9106a0a760caa065d3d70de90f78785b3693e2238ed7faafde0db473481a96b297469cbf18b5f2c98318760
SSDEEP

6144:Qu08o/fSiyJrPEzDkxALSlHU3PIyc4GTgE5BbGIgzp8ClwThY80fax3upn0wio:Q1X4JrPEHuCu03PIfTgk6lflwTJRx3gz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 1356	2996	rundll32.exe	31
PID 2996 wrote to memory of 1356	2996	rundll32.exe	31
PID 2996 wrote to memory of 1356	2996	rundll32.exe	31
PID 2996 wrote to memory of 1356	2996	rundll32.exe	31
PID 2996 wrote to memory of 1356	2996	rundll32.exe	31
PID 2996 wrote to memory of 1356	2996	rundll32.exe	31
PID 2996 wrote to memory of 1356	2996	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dd71e2054401384d497ce8a7bc48568_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dd71e2054401384d497ce8a7bc48568_JaffaCakes118.dll,#1
  2⤵
  PID:1356

memory/1356-1-0x00000000021E0000-0x0000000002220000-memory.dmp

Filesize
256KB

Download
memory/1356-0-0x00000000021E0000-0x0000000002220000-memory.dmp

Filesize
256KB

Download
memory/1356-2-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download