7cff973992d4b6309a47e4f417633173ce61071db0343ff98ad963beed08a2b3

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 05:19

Target

f51e1478c82cd7a092db846c4f176e58_JaffaCakes118.dll
Size

67KB
MD5

f51e1478c82cd7a092db846c4f176e58
SHA1

db5471e5dd90443916444edb916b1ffd2956872e
SHA256

7cff973992d4b6309a47e4f417633173ce61071db0343ff98ad963beed08a2b3
SHA512

919a0d9eb8c7266aa8fd02d44fa40f55e812a27221ebcb12e15a18f0d4221de99e4789af3711d05bcd5fb172639d99352925b5f7d88349d9393855f61939530b
SSDEEP

1536:Bm1NGJVG0YHrGsKCKSmvSYXRowSzyATa7JRKCXG3xtfkZAe/:kX0VvYHSdCK9dIyAu7zaeZAi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2280	1152	rundll32.exe	28
PID 1152 wrote to memory of 2280	1152	rundll32.exe	28
PID 1152 wrote to memory of 2280	1152	rundll32.exe	28
PID 1152 wrote to memory of 2280	1152	rundll32.exe	28
PID 1152 wrote to memory of 2280	1152	rundll32.exe	28
PID 1152 wrote to memory of 2280	1152	rundll32.exe	28
PID 1152 wrote to memory of 2280	1152	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f51e1478c82cd7a092db846c4f176e58_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f51e1478c82cd7a092db846c4f176e58_JaffaCakes118.dll,#1
  2⤵
  PID:2280

memory/2280-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2280-1-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download