5e45ccd2b6bfeb5cbe8cd04c5805e6be583c660627d5d8fd6b878ffe623ef00e

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 20:27

Target

f4431715cb8917d6299c3fd8e4ecc607_JaffaCakes118.dll
Size

152KB
MD5

f4431715cb8917d6299c3fd8e4ecc607
SHA1

93d2efbaa4855c1aef3c92930880a9708a6dcf6a
SHA256

5e45ccd2b6bfeb5cbe8cd04c5805e6be583c660627d5d8fd6b878ffe623ef00e
SHA512

bcb64eafee4c13b18ef341581caf8f3c2f9cd49858cc03392daca982d873d418c8bc89436b92d1076b71b86c5d3e21b9f4609b37cd2786cd387d38168deaf266
SSDEEP

3072:diZWvizd9gdc6NNs7E6rMmQIBdNp8hqHLU5bnLDNINaydsU:di9J9gdlQXWwqhqrAPKh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2260	1956	rundll32.exe	28
PID 1956 wrote to memory of 2260	1956	rundll32.exe	28
PID 1956 wrote to memory of 2260	1956	rundll32.exe	28
PID 1956 wrote to memory of 2260	1956	rundll32.exe	28
PID 1956 wrote to memory of 2260	1956	rundll32.exe	28
PID 1956 wrote to memory of 2260	1956	rundll32.exe	28
PID 1956 wrote to memory of 2260	1956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4431715cb8917d6299c3fd8e4ecc607_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4431715cb8917d6299c3fd8e4ecc607_JaffaCakes118.dll,#1
  2⤵
  PID:2260

memory/2260-0-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/2260-1-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/2260-3-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/2260-4-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download
memory/2260-5-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2260-6-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/2260-9-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download