3cd0aec175db0fb0ab46fe7eca3749c3b82caa478d988dc8fd50b5b37a1fec42

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 18:02

Target

fd50df1d245855d805e281e54db14a0b_JaffaCakes118.dll
Size

97KB
MD5

fd50df1d245855d805e281e54db14a0b
SHA1

f4d5d24e7a0ed715a1475a2227030abb78317c26
SHA256

3cd0aec175db0fb0ab46fe7eca3749c3b82caa478d988dc8fd50b5b37a1fec42
SHA512

46b07b1f21589f66653865717d61447b48d4ef93c30a1244bc068eb6b686c4a6c53e90ec2bd871b23b22e0c2f6023f2117fa2a366431d0c55bd752e2cd4d2f83
SSDEEP

1536:eIb/I0ICkuvfZ/AuwKd6kaTEWFSPtcAJn91fpj/D7+C+Y/105b:eMzhxvfGK1wSPtNn1pj/DiCh10

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1616	2276	rundll32.exe	28
PID 2276 wrote to memory of 1616	2276	rundll32.exe	28
PID 2276 wrote to memory of 1616	2276	rundll32.exe	28
PID 2276 wrote to memory of 1616	2276	rundll32.exe	28
PID 2276 wrote to memory of 1616	2276	rundll32.exe	28
PID 2276 wrote to memory of 1616	2276	rundll32.exe	28
PID 2276 wrote to memory of 1616	2276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd50df1d245855d805e281e54db14a0b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd50df1d245855d805e281e54db14a0b_JaffaCakes118.dll,#1
  2⤵
  PID:1616

memory/1616-0-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download