ba9b75330fb64de71410329bcdd7ab1e1a9721f369aa1c26a610d03efc19438c

Analysis

max time kernel
142s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 21:05

Target

f453394ddce07a6837b8884b9ffdc4c7_JaffaCakes118.dll
Size

106KB
MD5

f453394ddce07a6837b8884b9ffdc4c7
SHA1

78196e919f83c786acbe43e12efc4b373f49b900
SHA256

ba9b75330fb64de71410329bcdd7ab1e1a9721f369aa1c26a610d03efc19438c
SHA512

f149df4901284ba2efc9925b8ddc35707146290735fb07fed83b8489b139addfef3060bcd0a2d4cce642cbd043a15c02e4ea507d0bdca2049eab559ee4b56f0c
SSDEEP

1536:6BrPqz2747sE8nlUxJfvSGAMxSgo8bJgDzf1f6eejLAHnToIfxIO8dCPbwAr19:6BD47NFPfK6xjcRf6eBHTBfb82H9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1696	2352	rundll32.exe	28
PID 2352 wrote to memory of 1696	2352	rundll32.exe	28
PID 2352 wrote to memory of 1696	2352	rundll32.exe	28
PID 2352 wrote to memory of 1696	2352	rundll32.exe	28
PID 2352 wrote to memory of 1696	2352	rundll32.exe	28
PID 2352 wrote to memory of 1696	2352	rundll32.exe	28
PID 2352 wrote to memory of 1696	2352	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f453394ddce07a6837b8884b9ffdc4c7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f453394ddce07a6837b8884b9ffdc4c7_JaffaCakes118.dll,#1
  2⤵
  PID:1696

memory/1696-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1696-1-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1696-2-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1696-4-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1696-6-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1696-7-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1696-8-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1696-10-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1696-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1696-13-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download