88cf2025a96bc5a45f86e8e464605d3ea352446a9fb8b2fbf327f6b1e20953c3

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 23:46

Target

f904bf6e152f648c3151029395c6f50d_JaffaCakes118.dll
Size

28KB
MD5

f904bf6e152f648c3151029395c6f50d
SHA1

32293fed38f66f41d32875eb896f2c3ec2d4a27d
SHA256

88cf2025a96bc5a45f86e8e464605d3ea352446a9fb8b2fbf327f6b1e20953c3
SHA512

9260f25d4ed0f8ab4fba1a3e5c3b454e5867fa9bcbd74621a463c505705a860caa8ea33a0429b6a3471c24563b091e5bce5bd233915f6fe8650cdc1e46b3649a
SSDEEP

768:FnPSh/S9+ihCo9jtYB8Bhh6ax6htCmqqOQSnn8MyvGqa0XZcYMx:FKgY29Bhh6GtmqqbW9ERacZ0x

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1940	1132	rundll32.exe	28
PID 1132 wrote to memory of 1940	1132	rundll32.exe	28
PID 1132 wrote to memory of 1940	1132	rundll32.exe	28
PID 1132 wrote to memory of 1940	1132	rundll32.exe	28
PID 1132 wrote to memory of 1940	1132	rundll32.exe	28
PID 1132 wrote to memory of 1940	1132	rundll32.exe	28
PID 1132 wrote to memory of 1940	1132	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f904bf6e152f648c3151029395c6f50d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f904bf6e152f648c3151029395c6f50d_JaffaCakes118.dll,#1
  2⤵
  PID:1940

memory/1940-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1940-1-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1940-2-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download