5c27b1c4ef5affda584c219ba750d2ef0b09969f63ef51953e30a743d1789f77

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 09:33

Target

f7b8973952f1605e9cb50d8c417cd925_JaffaCakes118.dll
Size

132KB
MD5

f7b8973952f1605e9cb50d8c417cd925
SHA1

0ab8b5e1fa83ce1333877b2754233d07f5952763
SHA256

5c27b1c4ef5affda584c219ba750d2ef0b09969f63ef51953e30a743d1789f77
SHA512

6302e3ffd77751eec967290d915ee31280520d8344ce58718ed7797f4c4ebf1883b83e58b44c58ce7a65a13b30a08446e37b1cdddb91232fc47c249e99885f63
SSDEEP

1536:lEOuV6lxB2qkayekQAHcODQONc8+P93GFoFH32FmlD9/8ekeGYMLEom+2vF4NAhC:lde6X2DHr3cnPJgk2gDRSLLCvF7hBs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2168	2164	rundll32.exe	28
PID 2164 wrote to memory of 2168	2164	rundll32.exe	28
PID 2164 wrote to memory of 2168	2164	rundll32.exe	28
PID 2164 wrote to memory of 2168	2164	rundll32.exe	28
PID 2164 wrote to memory of 2168	2164	rundll32.exe	28
PID 2164 wrote to memory of 2168	2164	rundll32.exe	28
PID 2164 wrote to memory of 2168	2164	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7b8973952f1605e9cb50d8c417cd925_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7b8973952f1605e9cb50d8c417cd925_JaffaCakes118.dll,#1
  2⤵
  PID:2168

memory/2168-0-0x00000000000F0000-0x00000000000FD000-memory.dmp

Filesize
52KB

Download
memory/2168-1-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2168-5-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2168-6-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2168-7-0x00000000000F0000-0x00000000000F6000-memory.dmp

Filesize
24KB

Download