2989d773886fb240744354bd0c2b3db549930c20d98ec937f14d7b101f7f443d

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 20:13

Target

f43de676aea8ffa0ffaf6592ffc9fabd_JaffaCakes118.dll
Size

9KB
MD5

f43de676aea8ffa0ffaf6592ffc9fabd
SHA1

f1e555f6bef84764791ec546104cc4a434240c88
SHA256

2989d773886fb240744354bd0c2b3db549930c20d98ec937f14d7b101f7f443d
SHA512

fdc612ad15bb1d8510e396367e3b20e9f92ebde80bbd5b1a98e8e91a9d22350fec4bcbbcecc0eee039efdda5e3d3d31f8754b424a3a988d4054df96553830faf
SSDEEP

192:eoIeKkpZRl2DxVJyPtfnq9wfYt0jn6Xjm15uxe/mcxO3azB5kgUwuI:DhdsdfyPtfnq9wfYt0jumbux0bIl+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3012	3032	rundll32.exe	28
PID 3032 wrote to memory of 3012	3032	rundll32.exe	28
PID 3032 wrote to memory of 3012	3032	rundll32.exe	28
PID 3032 wrote to memory of 3012	3032	rundll32.exe	28
PID 3032 wrote to memory of 3012	3032	rundll32.exe	28
PID 3032 wrote to memory of 3012	3032	rundll32.exe	28
PID 3032 wrote to memory of 3012	3032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f43de676aea8ffa0ffaf6592ffc9fabd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f43de676aea8ffa0ffaf6592ffc9fabd_JaffaCakes118.dll,#1
  2⤵
  PID:3012

memory/3012-0-0x0000000025000000-0x0000000025017000-memory.dmp

Filesize
92KB

Download
memory/3012-1-0x0000000025000000-0x0000000025017000-memory.dmp

Filesize
92KB

Download