7de6610cb3b6acd993915ca9734770d539a8fb28b97d38f3b9101e1067ad0564

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 23:05

Target

f8f33fbb23a67b1140c918063c947f52_JaffaCakes118.dll
Size

123KB
MD5

f8f33fbb23a67b1140c918063c947f52
SHA1

92ecea6803089764bf21375e9fdbd0f480f29470
SHA256

7de6610cb3b6acd993915ca9734770d539a8fb28b97d38f3b9101e1067ad0564
SHA512

8b462eaf50673b7bb7c0f7487ceb644e43a833a9d05397bcad3320e8e160fb99909678d0afdcf5be6311d9a45f0f6bcda730c059d11093f750044254b57a4f26
SSDEEP

3072:rSznVa22olGyU26MKJtSfD2FFQ4uUDC4kq63C1cFYYV0B9lc9:CabolGyU1KD8l6y1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2308	2040	rundll32.exe	28
PID 2040 wrote to memory of 2308	2040	rundll32.exe	28
PID 2040 wrote to memory of 2308	2040	rundll32.exe	28
PID 2040 wrote to memory of 2308	2040	rundll32.exe	28
PID 2040 wrote to memory of 2308	2040	rundll32.exe	28
PID 2040 wrote to memory of 2308	2040	rundll32.exe	28
PID 2040 wrote to memory of 2308	2040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8f33fbb23a67b1140c918063c947f52_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8f33fbb23a67b1140c918063c947f52_JaffaCakes118.dll,#1
  2⤵
  PID:2308

memory/2308-0-0x0000000000190000-0x00000000001B3000-memory.dmp

Filesize
140KB

Download