0104f20ff030c06bafb2f132d8180dd5930452f999b60c9a7a4f83bccb06f016

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 06:53 UTC

Target

f0859dfcc2fb9611c1811ffb9c1b1498_JaffaCakes118.dll
Size

15KB
MD5

f0859dfcc2fb9611c1811ffb9c1b1498
SHA1

7607fc0d09443b177521aac784274fd9fee1d2c4
SHA256

0104f20ff030c06bafb2f132d8180dd5930452f999b60c9a7a4f83bccb06f016
SHA512

f1a21279440a1cf0e35465b46c2cf9df45e669e6d69a19d596c0e38a9a01054b3d3140aabedb85eade3a9bc6f79d71cbba999b629e7a8998b32680c843c63c22
SSDEEP

192:UnITMl2Zjs0/uA/OHoxgbTN+waBeHW5l7/vkQvvnyuh5E3pHAMy9UgvhB:UnIHZjs049TN6N7nlh5E1AMvgpB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2356	2340	rundll32.exe	28
PID 2340 wrote to memory of 2356	2340	rundll32.exe	28
PID 2340 wrote to memory of 2356	2340	rundll32.exe	28
PID 2340 wrote to memory of 2356	2340	rundll32.exe	28
PID 2340 wrote to memory of 2356	2340	rundll32.exe	28
PID 2340 wrote to memory of 2356	2340	rundll32.exe	28
PID 2340 wrote to memory of 2356	2340	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0859dfcc2fb9611c1811ffb9c1b1498_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0859dfcc2fb9611c1811ffb9c1b1498_JaffaCakes118.dll,#1
  2⤵
  PID:2356

memory/2356-0-0x0000000010000000-0x000000001006C000-memory.dmp

Filesize
432KB

Download