d075b5f98414b6ff7ef52e1d1aacd051b931b2a2572dfd8326ffd2b5edc5933f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 05:44

Target

fc0d73956f9065a6766e051ee79afe92_JaffaCakes118.dll
Size

104KB
MD5

fc0d73956f9065a6766e051ee79afe92
SHA1

c813b107627dd37b92b6ac9f65dc9037437a1c2f
SHA256

d075b5f98414b6ff7ef52e1d1aacd051b931b2a2572dfd8326ffd2b5edc5933f
SHA512

a83b270aea039d5106638903b007e1ea18526d4b8ae72fdb2dcb792d28d81113490a8f62ebd734125b229c1e3cf2708091a5413402a1dcf4a50d08efaa3d92c9
SSDEEP

3072:CjjonaqISR/8GTW68uLMLHM0WxvWOxwJpjLXT8lH:CPonaqr/9W6fLMLH4YOxUpjLXT8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2704	2744	rundll32.exe	28
PID 2744 wrote to memory of 2704	2744	rundll32.exe	28
PID 2744 wrote to memory of 2704	2744	rundll32.exe	28
PID 2744 wrote to memory of 2704	2744	rundll32.exe	28
PID 2744 wrote to memory of 2704	2744	rundll32.exe	28
PID 2744 wrote to memory of 2704	2744	rundll32.exe	28
PID 2744 wrote to memory of 2704	2744	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc0d73956f9065a6766e051ee79afe92_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc0d73956f9065a6766e051ee79afe92_JaffaCakes118.dll,#1
  2⤵
  PID:2704

memory/2704-1-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/2704-0-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/2704-5-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/2704-6-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download