f3dbc2e240a9aa22f219e0efefe9ef52fd83a8bc57f3bbc59a3e363f576398e8

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 11:01

Target

4e0358a525622edb28027f82193e84e8_JaffaCakes118.dll
Size

6KB
MD5

4e0358a525622edb28027f82193e84e8
SHA1

91c5ba09592b35bd36dffa4baec5b87a0909ecb3
SHA256

f3dbc2e240a9aa22f219e0efefe9ef52fd83a8bc57f3bbc59a3e363f576398e8
SHA512

360b3e79adfa005c7d0c5d7c15ea86f03a79478156bfc59558c7e6cd8f689c19b94baa8c370893bbff3c08cda7ecd6718f4d68eb8ae36a0fd6643d56ced6c42e
SSDEEP

48:aGy7MN4cpSGAXbIni1kvNs6ztutiKIZWiwQTnU5WwG2QozbC:xB4c4G6bn1k1sw0EW3enIWwGqb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 1120	2364	rundll32.exe	29
PID 2364 wrote to memory of 1120	2364	rundll32.exe	29
PID 2364 wrote to memory of 1120	2364	rundll32.exe	29
PID 2364 wrote to memory of 1120	2364	rundll32.exe	29
PID 2364 wrote to memory of 1120	2364	rundll32.exe	29
PID 2364 wrote to memory of 1120	2364	rundll32.exe	29
PID 2364 wrote to memory of 1120	2364	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e0358a525622edb28027f82193e84e8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e0358a525622edb28027f82193e84e8_JaffaCakes118.dll,#1
  2⤵
  PID:1120

memory/1120-0-0x00000000762F0000-0x00000000762F6000-memory.dmp

Filesize
24KB

Download
memory/1120-1-0x00000000762F0000-0x00000000762F6000-memory.dmp

Filesize
24KB

Download