e027f18e6c26758bf691bb42e363f53bdcd88d600e445a70ee2804e42e509969

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 22:58

Target

f483c3eb79decc305f734ac3a1bf664a_JaffaCakes118.dll
Size

73KB
MD5

f483c3eb79decc305f734ac3a1bf664a
SHA1

72e1b5ff2893a176032bcacd4f9e6b6f6385c7b9
SHA256

e027f18e6c26758bf691bb42e363f53bdcd88d600e445a70ee2804e42e509969
SHA512

81c11de9c0844b8fcd85d709fbd5667ebc77425f0d3392c8d1e41aa481f069e6bcc70ac367409ab8b3324159c7a275be22a6f61e0215ce3f8c18a0c42d9a20a5
SSDEEP

768:WoM0GmnqiMiayesAcrHw8Z4GBAFPmKHSvN47yP4i4nq8FZZS97gmjdKN8yv:8Dgq0pRZkF7I4WV4/s9LdKN8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1816	2020	rundll32.exe	28
PID 2020 wrote to memory of 1816	2020	rundll32.exe	28
PID 2020 wrote to memory of 1816	2020	rundll32.exe	28
PID 2020 wrote to memory of 1816	2020	rundll32.exe	28
PID 2020 wrote to memory of 1816	2020	rundll32.exe	28
PID 2020 wrote to memory of 1816	2020	rundll32.exe	28
PID 2020 wrote to memory of 1816	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f483c3eb79decc305f734ac3a1bf664a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f483c3eb79decc305f734ac3a1bf664a_JaffaCakes118.dll,#1
  2⤵
  PID:1816

memory/1816-0-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/1816-1-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/1816-2-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download