0f59cc328891e2358317e0a1a81719c0578f01bdaab476c81baea529c6085cb3

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 16:21

Target

f3db0cbfcc71dbe1a65bbf0dbf466d48_JaffaCakes118.dll
Size

55KB
MD5

f3db0cbfcc71dbe1a65bbf0dbf466d48
SHA1

29d5b8facfab0768c0c57f1813a53e1628f0c317
SHA256

0f59cc328891e2358317e0a1a81719c0578f01bdaab476c81baea529c6085cb3
SHA512

487a0291d3d7cfdb9abcf07c4a21a102468f5db4240a6d2e35d338687a44135f540340c647dca490110a33f1de8601bb18d1a39482bbac295ba6ac37e02a4748
SSDEEP

1536:kEoqnmQshnj8RwO0Dr+th2wp0wWNbVYqJtY4Cs6O:7mxlK0DO2wwNhYuaC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2872	2856	rundll32.exe	28
PID 2856 wrote to memory of 2872	2856	rundll32.exe	28
PID 2856 wrote to memory of 2872	2856	rundll32.exe	28
PID 2856 wrote to memory of 2872	2856	rundll32.exe	28
PID 2856 wrote to memory of 2872	2856	rundll32.exe	28
PID 2856 wrote to memory of 2872	2856	rundll32.exe	28
PID 2856 wrote to memory of 2872	2856	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3db0cbfcc71dbe1a65bbf0dbf466d48_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3db0cbfcc71dbe1a65bbf0dbf466d48_JaffaCakes118.dll,#1
  2⤵
  PID:2872

memory/2872-0-0x00000000001B0000-0x00000000001C2000-memory.dmp

Filesize
72KB

Download