33da577ee7b678badd45eb9397260499c939598b97d78e56680b03f959e1e139

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 07:48

Target

fecbb17e5cb7597b42599cca9f237c07_JaffaCakes118.dll
Size

144KB
MD5

fecbb17e5cb7597b42599cca9f237c07
SHA1

72ae165a7f94bcc20b5e31b5c1448e3123ecefc0
SHA256

33da577ee7b678badd45eb9397260499c939598b97d78e56680b03f959e1e139
SHA512

c329860a013b3f41102c1a95d9f811a6173eaa9f2610bb43eb50e698a79784843c99fc1bbc6af649be287d09c7fe8fb71a8b740efa6274dfd3397f5a01b36bd2
SSDEEP

3072:xsJktXqkaAp78heywCtFUulf5oKCrOlFHmg8t8vCS5:/tXqkaa4hzwadVyg8WCS5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2724	1888	rundll32.exe	28
PID 1888 wrote to memory of 2724	1888	rundll32.exe	28
PID 1888 wrote to memory of 2724	1888	rundll32.exe	28
PID 1888 wrote to memory of 2724	1888	rundll32.exe	28
PID 1888 wrote to memory of 2724	1888	rundll32.exe	28
PID 1888 wrote to memory of 2724	1888	rundll32.exe	28
PID 1888 wrote to memory of 2724	1888	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fecbb17e5cb7597b42599cca9f237c07_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fecbb17e5cb7597b42599cca9f237c07_JaffaCakes118.dll,#1
  2⤵
  PID:2724

memory/2724-0-0x000000006D0C0000-0x000000006D0E4000-memory.dmp

Filesize
144KB

Download
memory/2724-1-0x000000006D0C0000-0x000000006D0E4000-memory.dmp

Filesize
144KB

Download