bf2026f6fdcaa0b96ea50af13a39b357e529c8c21dcc747e1db0b25822aac9b1

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 02:06

Target

fe2e1c0c64647bfe5958b47dc4acbdc8_JaffaCakes118.dll
Size

52KB
MD5

fe2e1c0c64647bfe5958b47dc4acbdc8
SHA1

28b51623fe74cb33846deb2e817af957cbe8d4c4
SHA256

bf2026f6fdcaa0b96ea50af13a39b357e529c8c21dcc747e1db0b25822aac9b1
SHA512

eb739a616e33ba8c2f03d9903172859c86971511874c673e32e7994cc6b4e151119e55e59d5136d85ccdde0bd44383b1467e7b41cae0f857d968e4c6286551d1
SSDEEP

1536:0aRQ1YL9E2Da7NZ5Zdpj+Jjx1FEthd0IhwDmRj:zR/FD8ZPr+52d0Ij

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2952	2232	rundll32.exe	28
PID 2232 wrote to memory of 2952	2232	rundll32.exe	28
PID 2232 wrote to memory of 2952	2232	rundll32.exe	28
PID 2232 wrote to memory of 2952	2232	rundll32.exe	28
PID 2232 wrote to memory of 2952	2232	rundll32.exe	28
PID 2232 wrote to memory of 2952	2232	rundll32.exe	28
PID 2232 wrote to memory of 2952	2232	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe2e1c0c64647bfe5958b47dc4acbdc8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe2e1c0c64647bfe5958b47dc4acbdc8_JaffaCakes118.dll,#1
  2⤵
  PID:2952

memory/2952-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download