5bc5df0c0166406db6153b8edf67c23ea7e976b762f6083b4d075b8c5f10098f

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 02:44

Target

f01e4bf4e3ce1ef9316d37e6d6c66a99_JaffaCakes118.dll
Size

60KB
MD5

f01e4bf4e3ce1ef9316d37e6d6c66a99
SHA1

74aebda55a272900aef54b41f8c476e4cfe37170
SHA256

5bc5df0c0166406db6153b8edf67c23ea7e976b762f6083b4d075b8c5f10098f
SHA512

92b2590041d8cd7648bc32889cf3b872fb95854f8cc4ea0cc6eb07af799bbcacd009e60edf2908c230f99c3536767e0efd42db3fd15336edaf83993476bc6654
SSDEEP

768:nbY4lPl94PFBfgMk5jFV5EbNOFlM/eLzl8RXZpLG0oLwJFZaUTVdgTWrM6neSwtA:EGf4PPgMwuAFe/1JqbcJJhdoN6ne1A

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2532	2908	rundll32.exe	28
PID 2908 wrote to memory of 2532	2908	rundll32.exe	28
PID 2908 wrote to memory of 2532	2908	rundll32.exe	28
PID 2908 wrote to memory of 2532	2908	rundll32.exe	28
PID 2908 wrote to memory of 2532	2908	rundll32.exe	28
PID 2908 wrote to memory of 2532	2908	rundll32.exe	28
PID 2908 wrote to memory of 2532	2908	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f01e4bf4e3ce1ef9316d37e6d6c66a99_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f01e4bf4e3ce1ef9316d37e6d6c66a99_JaffaCakes118.dll,#1
  2⤵
  PID:2532

memory/2532-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download