d766e6c1747a8f725f15573d68366cfa4b61d97f1ba81eb75fc017245b275801

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 19:22

Target

fd75f709c1c8fa33cea8634c746300de_JaffaCakes118.dll
Size

25KB
MD5

fd75f709c1c8fa33cea8634c746300de
SHA1

021d4d1ed4204dd757f34889e35011b079d57f73
SHA256

d766e6c1747a8f725f15573d68366cfa4b61d97f1ba81eb75fc017245b275801
SHA512

bbe0d9bc14ff472d1c684aef29d1f5531823531427dde0d2a966d47980bc9584bb75fe281c64b321c7323c95a50f71c6aa5555f6b171ce3431f699efd182165a
SSDEEP

384:FcBJ70u0jrMSV52tue37tXgCa5mrQrB8sHa405xN4ocB+1lhSTatRxtGP1:qT7xmV52tuY7+RssHgjLnhmSRxY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd75f709c1c8fa33cea8634c746300de_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd75f709c1c8fa33cea8634c746300de_JaffaCakes118.dll,#1
  2⤵
  PID:1784

memory/1784-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1784-1-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1784-2-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download