20030ddbdc15cdabf7c5cb18ad978dd7201169809a4464cefc68cf519c55bf97

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 18:51

Target

faf21750edfbd70d5d34497f87302821_JaffaCakes118.dll
Size

128KB
MD5

faf21750edfbd70d5d34497f87302821
SHA1

8ca9852a009c1d48cef6515dd471aa3ba648f32c
SHA256

20030ddbdc15cdabf7c5cb18ad978dd7201169809a4464cefc68cf519c55bf97
SHA512

84abdec5d4a0cda4e625b77ae7b0c1442d9bf669762063c5c13c0fa7eac74ce4846c15fc28f8c4b3c2e65763c5422d88406f83e55aba4116bda7304115a1f63f
SSDEEP

3072:94sfMsY/e8GmQpUZiJ+9qXdKUJonKtHXedAI7Yiqw:OSMNzQpUZy1o03mY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1036	2200	rundll32.exe	28
PID 2200 wrote to memory of 1036	2200	rundll32.exe	28
PID 2200 wrote to memory of 1036	2200	rundll32.exe	28
PID 2200 wrote to memory of 1036	2200	rundll32.exe	28
PID 2200 wrote to memory of 1036	2200	rundll32.exe	28
PID 2200 wrote to memory of 1036	2200	rundll32.exe	28
PID 2200 wrote to memory of 1036	2200	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\faf21750edfbd70d5d34497f87302821_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\faf21750edfbd70d5d34497f87302821_JaffaCakes118.dll,#1
  2⤵
  PID:1036

memory/1036-0-0x0000000000140000-0x000000000014D000-memory.dmp

Filesize
52KB

Download
memory/1036-1-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/1036-5-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/1036-6-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/1036-7-0x0000000000140000-0x0000000000142000-memory.dmp

Filesize
8KB

Download