95a635d445577fc8a905df5d2592ceaba8ccbd49848a5a317388581e51a2936b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 18:29

Target

f88502df61f5827bded120acc62aa535_JaffaCakes118.dll
Size

251KB
MD5

f88502df61f5827bded120acc62aa535
SHA1

a98cfc03a06f75cbe34104eb3842bfc7ce4c601d
SHA256

95a635d445577fc8a905df5d2592ceaba8ccbd49848a5a317388581e51a2936b
SHA512

ded59d4d3823ce925018b925c37d554f7047f8afb66e344e2e3b07d877a1cc748cf99a7a1389415b5f50462691a581596992e9a5b2e93c7d642a595e632e9c3c
SSDEEP

3072:Huzi84ekVJyAVG8glW8dhtXFDlaetAqKBpJixzYfK4DPeq411J4oIX1cd3XVildR:HuR3GY8gwyJ9t5byf7oIXuhHUGeu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1920	1968	rundll32.exe	28
PID 1968 wrote to memory of 1920	1968	rundll32.exe	28
PID 1968 wrote to memory of 1920	1968	rundll32.exe	28
PID 1968 wrote to memory of 1920	1968	rundll32.exe	28
PID 1968 wrote to memory of 1920	1968	rundll32.exe	28
PID 1968 wrote to memory of 1920	1968	rundll32.exe	28
PID 1968 wrote to memory of 1920	1968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f88502df61f5827bded120acc62aa535_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f88502df61f5827bded120acc62aa535_JaffaCakes118.dll,#1
  2⤵
  PID:1920

memory/1920-1-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1920-0-0x0000000000220000-0x000000000025F000-memory.dmp

Filesize
252KB

Download