c98d776e803d93272dc1f718ac94d29212ef326423b921ce9f5d60d400dc3c16

Analysis

max time kernel
33s
max time network
19s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 12:34

Target

fa4e896207d4d6f2c5e552622aaaf75c_JaffaCakes118.dll
Size

34KB
MD5

fa4e896207d4d6f2c5e552622aaaf75c
SHA1

35418287e0d0e388c27d277162eecccb7b6d036f
SHA256

c98d776e803d93272dc1f718ac94d29212ef326423b921ce9f5d60d400dc3c16
SHA512

aff3045cbf4812ab905ce6d5267599212cb251913d9a6584204e2cc26b207464f251d17501f9e6849e0e79138eeca8e7bab7f1e258226f61425b3d59209bd2af
SSDEEP

768:1x4KfVueiokuD3S3hoxwWFiPS03PyBK2s1Jg+9W:1xRXmuD3S3cwEit6g2sgIW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2632	2576	rundll32.exe	28
PID 2576 wrote to memory of 2632	2576	rundll32.exe	28
PID 2576 wrote to memory of 2632	2576	rundll32.exe	28
PID 2576 wrote to memory of 2632	2576	rundll32.exe	28
PID 2576 wrote to memory of 2632	2576	rundll32.exe	28
PID 2576 wrote to memory of 2632	2576	rundll32.exe	28
PID 2576 wrote to memory of 2632	2576	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa4e896207d4d6f2c5e552622aaaf75c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa4e896207d4d6f2c5e552622aaaf75c_JaffaCakes118.dll,#1
  2⤵
  PID:2632

memory/2632-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2632-1-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download