4da15514ef003de6134bf945fef6fca1badd8390cec5c498ba50463fd2dd1de5

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 12:16

Target

ed66c0bba85241a86563230f1c8023ff_JaffaCakes118.dll
Size

162KB
MD5

ed66c0bba85241a86563230f1c8023ff
SHA1

4c7531ba2f6b6fa3ef74ace75c2f0bf1bafb3b64
SHA256

4da15514ef003de6134bf945fef6fca1badd8390cec5c498ba50463fd2dd1de5
SHA512

a0204b9e6450aee558e592b5c213b8c6acfc5ee8dbc61544540b8c72f51fa22df9e94435895b783e582947987ecffeda633f398239efe9fcbdb02c468a6e122c
SSDEEP

1536:ZxVyfNqLBIPGXsEr0eHZ8fltymIlwLZ3vc++wh2WLJgFWfnj/2w:ZxVoNqNIeXsErWtyDq13vc+L26yWvz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2060	2364	rundll32.exe	28
PID 2364 wrote to memory of 2060	2364	rundll32.exe	28
PID 2364 wrote to memory of 2060	2364	rundll32.exe	28
PID 2364 wrote to memory of 2060	2364	rundll32.exe	28
PID 2364 wrote to memory of 2060	2364	rundll32.exe	28
PID 2364 wrote to memory of 2060	2364	rundll32.exe	28
PID 2364 wrote to memory of 2060	2364	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed66c0bba85241a86563230f1c8023ff_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed66c0bba85241a86563230f1c8023ff_JaffaCakes118.dll,#1
  2⤵
  PID:2060

memory/2060-0-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download
memory/2060-1-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download