3f642e7aa037be2b18cb68c0bb34444ddf10c423554e9f93261bef1821ea0a7f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 23:14

Target

f225283ffb1ba5d542683abfa5263d69_JaffaCakes118.dll
Size

546KB
MD5

f225283ffb1ba5d542683abfa5263d69
SHA1

519b39db235666e6a976aae57cfad2d7d55eafa1
SHA256

3f642e7aa037be2b18cb68c0bb34444ddf10c423554e9f93261bef1821ea0a7f
SHA512

f04470a687b5cc7a3a2bd816aba63ad6b2c0eead5e9476c95b3e909763184afd0e026d82648899557576436ef7509576b6363abeef0f8b8b545c0a7d9205aa43
SSDEEP

12288:ep9qDJSBDz6m5c7O4iBPiXlYB9ooxW5E+yYNTPOVt:afBDzr5VDaeToj9ygOVt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2916	2784	rundll32.exe	28
PID 2784 wrote to memory of 2916	2784	rundll32.exe	28
PID 2784 wrote to memory of 2916	2784	rundll32.exe	28
PID 2784 wrote to memory of 2916	2784	rundll32.exe	28
PID 2784 wrote to memory of 2916	2784	rundll32.exe	28
PID 2784 wrote to memory of 2916	2784	rundll32.exe	28
PID 2784 wrote to memory of 2916	2784	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f225283ffb1ba5d542683abfa5263d69_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f225283ffb1ba5d542683abfa5263d69_JaffaCakes118.dll,#1
  2⤵
  PID:2916

memory/2916-0-0x0000000020000000-0x000000002000C000-memory.dmp

Filesize
48KB

Download