deaa1aa37f8903bcfd38c2949f64c0707b8bd97b117110b8a0425e37017b1076

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 17:38

Target

f3fd15cddcf481f6b40046f6cb736b00_JaffaCakes118.dll
Size

35KB
MD5

f3fd15cddcf481f6b40046f6cb736b00
SHA1

18dae6b8c8df93931c88d1ef3e24ac7a823aa462
SHA256

deaa1aa37f8903bcfd38c2949f64c0707b8bd97b117110b8a0425e37017b1076
SHA512

35a3451d1737e0cb2ee93f9291e0ee6a3513d7f451ef57c5e8896cbdcc767e89dbe1744da0c9c13d300799d58961c60eb606b6d4c94e89609345901a5dc23058
SSDEEP

384:oOzikzyyly8yIXbNaeLWFKiAQ8GPUTd4ZLz6wYL7iCPFyeVLXGF93DjtQJBPX+T9:vs8yItCFYGHvYKCPFye92HvtSjT+5cf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1736	2012	rundll32.exe	28
PID 2012 wrote to memory of 1736	2012	rundll32.exe	28
PID 2012 wrote to memory of 1736	2012	rundll32.exe	28
PID 2012 wrote to memory of 1736	2012	rundll32.exe	28
PID 2012 wrote to memory of 1736	2012	rundll32.exe	28
PID 2012 wrote to memory of 1736	2012	rundll32.exe	28
PID 2012 wrote to memory of 1736	2012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3fd15cddcf481f6b40046f6cb736b00_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3fd15cddcf481f6b40046f6cb736b00_JaffaCakes118.dll,#1
  2⤵
  PID:1736

memory/1736-0-0x0000000000100000-0x000000000010F000-memory.dmp

Filesize
60KB

Download