8e1235c9d89b045e71bc748e2a3640baa006579e1f9f02bfc1d269c291889cba

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 05:07

Target

f2c117501fddbe4b43835681c8fb7dd2_JaffaCakes118.dll
Size

190KB
MD5

f2c117501fddbe4b43835681c8fb7dd2
SHA1

efb389307c5bc954a2b1c33372a8b7580fefbceb
SHA256

8e1235c9d89b045e71bc748e2a3640baa006579e1f9f02bfc1d269c291889cba
SHA512

009aa5424a2985dd73a06fff0fbb4c39ff924a738bb4e9ba0e14b4f47c1c079ec5ed313c86038a675f2705a8409d755392555acc8164975b674311fc6b30f76c
SSDEEP

3072:V8+ZH3QKakSgZfPiavu7nh4WKwE4trX1LKiM69lgdHXct+Z3lu/s4OnUr:VJgr3AiavcfKf43LBQBXc8k/ROn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2904	2876	rundll32.exe	28
PID 2876 wrote to memory of 2904	2876	rundll32.exe	28
PID 2876 wrote to memory of 2904	2876	rundll32.exe	28
PID 2876 wrote to memory of 2904	2876	rundll32.exe	28
PID 2876 wrote to memory of 2904	2876	rundll32.exe	28
PID 2876 wrote to memory of 2904	2876	rundll32.exe	28
PID 2876 wrote to memory of 2904	2876	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2c117501fddbe4b43835681c8fb7dd2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2c117501fddbe4b43835681c8fb7dd2_JaffaCakes118.dll,#1
  2⤵
  PID:2904

memory/2904-0-0x0000000000220000-0x000000000024D000-memory.dmp

Filesize
180KB

Download
memory/2904-1-0x0000000010000000-0x000000001005D000-memory.dmp

Filesize
372KB

Download