2e55d1fdeb564e956bd12901b636fd24f603507d402d3b9f76a92f570b639e1f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 22:24

Target

f476b7c2101a6f063ccb6c85b2c65e29_JaffaCakes118.dll
Size

308KB
MD5

f476b7c2101a6f063ccb6c85b2c65e29
SHA1

ddeca0d366f7eac5d8100431e36b4bd27cfba438
SHA256

2e55d1fdeb564e956bd12901b636fd24f603507d402d3b9f76a92f570b639e1f
SHA512

7cb968e97db25c4618516115fc936b07ad92b1d9bef3ce4d98f778feb1af065405c7c7bfcbcfc251a5acb9ec4f720a9930e47f8d1627da6da4479f8a46ad842c
SSDEEP

6144:aJvdVUYvY2KLfn84k5xQpTaVAwYzzO9Lm0abfm1:aJvdDw2Wtk5xCTIYw0fm1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2956	3028	rundll32.exe	28
PID 3028 wrote to memory of 2956	3028	rundll32.exe	28
PID 3028 wrote to memory of 2956	3028	rundll32.exe	28
PID 3028 wrote to memory of 2956	3028	rundll32.exe	28
PID 3028 wrote to memory of 2956	3028	rundll32.exe	28
PID 3028 wrote to memory of 2956	3028	rundll32.exe	28
PID 3028 wrote to memory of 2956	3028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f476b7c2101a6f063ccb6c85b2c65e29_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f476b7c2101a6f063ccb6c85b2c65e29_JaffaCakes118.dll,#1
  2⤵
  PID:2956

memory/2956-1-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download
memory/2956-2-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download
memory/2956-3-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download