fe628b93aa96bebdba80c80efc742c62bdc9a7948e46fbb740177f58bee66695

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 03:47

Target

fbdb2a015fffa3255991b02c050280b1_JaffaCakes118.dll
Size

560KB
MD5

fbdb2a015fffa3255991b02c050280b1
SHA1

6edae220899e6800ccb95e46b84249536e99ef55
SHA256

fe628b93aa96bebdba80c80efc742c62bdc9a7948e46fbb740177f58bee66695
SHA512

128a614f359731b72ef87877a6b0fdea26759a6e2a1c84a138333c08920dd31b07a5951a366190db223152b63ac375b99675b0b6878c1b49ce96fa9022d64dc4
SSDEEP

12288:svbv8DhhNkVXqpoAGCKcZFLzY762EXBSn49W9t/WaceipEXWO:IMhhoXqm8VzFJXMnJ9WLecuJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2340	2344	rundll32.exe	28
PID 2344 wrote to memory of 2340	2344	rundll32.exe	28
PID 2344 wrote to memory of 2340	2344	rundll32.exe	28
PID 2344 wrote to memory of 2340	2344	rundll32.exe	28
PID 2344 wrote to memory of 2340	2344	rundll32.exe	28
PID 2344 wrote to memory of 2340	2344	rundll32.exe	28
PID 2344 wrote to memory of 2340	2344	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbdb2a015fffa3255991b02c050280b1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbdb2a015fffa3255991b02c050280b1_JaffaCakes118.dll,#1
  2⤵
  PID:2340