da723591653eed629452ec3ee217a897296ccaca1bb5fae8dceb8ae3a855c352

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 17:47

Target

f1a1c11ab4cc45bac3e1e92e2875aad0_JaffaCakes118.dll
Size

44KB
MD5

f1a1c11ab4cc45bac3e1e92e2875aad0
SHA1

9ad4f8a0f7b6fe010fafdeb38cee3a838d1170b2
SHA256

da723591653eed629452ec3ee217a897296ccaca1bb5fae8dceb8ae3a855c352
SHA512

dda78eb0d1560f91222497c37081a98718ed36aef197e60798924aed7a78c546d126028f10410eca9fc2e9f835131359b7bc1b60ee982023a7df4aae9e5171ec
SSDEEP

768:wEsWg8F9QNZF0GvuhSnZ6ttEre9cTnjGa3yMuoIfopzZYiCG1voN6:xsd8zcZqSZfrA4n6a3yXw4UVE6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1708	2224	rundll32.exe	28
PID 2224 wrote to memory of 1708	2224	rundll32.exe	28
PID 2224 wrote to memory of 1708	2224	rundll32.exe	28
PID 2224 wrote to memory of 1708	2224	rundll32.exe	28
PID 2224 wrote to memory of 1708	2224	rundll32.exe	28
PID 2224 wrote to memory of 1708	2224	rundll32.exe	28
PID 2224 wrote to memory of 1708	2224	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1a1c11ab4cc45bac3e1e92e2875aad0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1a1c11ab4cc45bac3e1e92e2875aad0_JaffaCakes118.dll,#1
  2⤵
  PID:1708

memory/1708-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/1708-1-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download
memory/1708-5-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download
memory/1708-6-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download