20dcb7b80348ceab1ce8652561663341ca10e92b4456f65bf266ec9944543041

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 07:15

Target

febca5d180cdf8813cd9f58066b0ddd0_JaffaCakes118.dll
Size

140KB
MD5

febca5d180cdf8813cd9f58066b0ddd0
SHA1

190a2b9beb5a555ef771fe55c93dddecbff4a959
SHA256

20dcb7b80348ceab1ce8652561663341ca10e92b4456f65bf266ec9944543041
SHA512

d3fc46fe3f58364f2ddd121103340753e7a9c55830aa326756bc7837f90d416aa0992f8297d3d1fc6b90b40ec904662848a1bfa70b68c7fca2fc8482c6de5c07
SSDEEP

1536:h/M1ySKPnTMrvW4wX+OQKRlLHl0elQnrc8HrR8UdvSlCSic0XZ/uACiCN6axSA:h/GsYrkI2Dl0elQrcCvSzi/pOdNTR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\febca5d180cdf8813cd9f58066b0ddd0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\febca5d180cdf8813cd9f58066b0ddd0_JaffaCakes118.dll,#1
  2⤵
  PID:2160

memory/2160-0-0x0000000000170000-0x000000000017F000-memory.dmp

Filesize
60KB

Download
memory/2160-1-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/2160-3-0x0000000000170000-0x000000000017F000-memory.dmp

Filesize
60KB

Download
memory/2160-2-0x0000000000160000-0x000000000016F000-memory.dmp

Filesize
60KB

Download