29fac454214d38134a1fc604a7217473c6d0b7b640bc8bd20434e4dfd7bcd89b

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 15:05

Target

f8425111990f9e6eb6d110d38b498ec4_JaffaCakes118.dll
Size

80KB
MD5

f8425111990f9e6eb6d110d38b498ec4
SHA1

dc4ac7e5b65cae8e14d2f3a4f956576fa09b3176
SHA256

29fac454214d38134a1fc604a7217473c6d0b7b640bc8bd20434e4dfd7bcd89b
SHA512

58038a20cfb8aa4c9d40d137334bb4313174510b519360abe17c19f35206b74e9a565aea0ba9358908cb83f1fbd45af94db188a040fe5417237c6c2c0121ffa4
SSDEEP

1536:wZuGEXEqGdedNDC4QuJYVC/9B9EMakmUts38bYutFcdj5WZyNe6Lv:wZuGEX51CqYClBvE4s380ycdVWZyN77

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 1084	3016	rundll32.exe	28
PID 3016 wrote to memory of 1084	3016	rundll32.exe	28
PID 3016 wrote to memory of 1084	3016	rundll32.exe	28
PID 3016 wrote to memory of 1084	3016	rundll32.exe	28
PID 3016 wrote to memory of 1084	3016	rundll32.exe	28
PID 3016 wrote to memory of 1084	3016	rundll32.exe	28
PID 3016 wrote to memory of 1084	3016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8425111990f9e6eb6d110d38b498ec4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8425111990f9e6eb6d110d38b498ec4_JaffaCakes118.dll,#1
  2⤵
  PID:1084

memory/1084-0-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download