f67bdc63385f4edd1db847392b55d9e5a21397cfe69ba3d3e77317d92ab12b17

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 16:53

Target

013949e85d5aa0498e9ccfd69813ee84_JaffaCakes118.dll
Size

5KB
MD5

013949e85d5aa0498e9ccfd69813ee84
SHA1

0b1fe922af1f7b0a36479b3ab4a2dd7af4e52dc4
SHA256

f67bdc63385f4edd1db847392b55d9e5a21397cfe69ba3d3e77317d92ab12b17
SHA512

2820f3710e300326280dcf99d3b7b270489dfb18127a8ff3dab7721523d3236d8ce14add94609f8c187e0e24922f5a4ffe2f356af2112adb8ac60505e2fd357c
SSDEEP

96:EOBFqD88h3ufuVrYBjAPltste/hI1knzmcfnp3N:xF/8hefuVris9tIahsSqYp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\013949e85d5aa0498e9ccfd69813ee84_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\013949e85d5aa0498e9ccfd69813ee84_JaffaCakes118.dll,#1
  2⤵
  PID:912

memory/912-3-0x0000000063AC0000-0x0000000063AC9000-memory.dmp

Filesize
36KB

Download
memory/912-2-0x0000000063AC0000-0x0000000063AC9000-memory.dmp

Filesize
36KB

Download
memory/912-1-0x0000000063AC0000-0x0000000063AC9000-memory.dmp

Filesize
36KB

Download
memory/912-0-0x0000000063AC0000-0x0000000063AC9000-memory.dmp

Filesize
36KB

Download