d66141bdfe66974c3f46f043af8003958a4b075c0d1058072826bf71ed6a9772

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 03:02

Target

f95c12ffe59d184431daec724be28894_JaffaCakes118.dll
Size

758KB
MD5

f95c12ffe59d184431daec724be28894
SHA1

bb526bb357e1b5b8489583a074360548d4261fff
SHA256

d66141bdfe66974c3f46f043af8003958a4b075c0d1058072826bf71ed6a9772
SHA512

2bec0159b7535ab12fdd2324c5f5cb134938dc4ad32772b22855a9a9dacb1bd355ce673a87969ddbde0fd318e6b504f40060ffc5361c9ef43f8f693f088ed4f4
SSDEEP

192:QPMT/KSXU430GRbjcdHEZNltr9ieoPQiu6rU5fz5deF04VCbcTAjttYAyF8pMy6B:n/KSXS+w6Lok64TAu/vKfy6K0o4d

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f95c12ffe59d184431daec724be28894_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f95c12ffe59d184431daec724be28894_JaffaCakes118.dll,#1
  2⤵
  PID:2368

memory/2368-0-0x0000000020000000-0x000000002006C000-memory.dmp

Filesize
432KB

Download