6f6d4f3090669a12b7870d959302181d721436520374a4115e6c7bcfbc21cfef

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03-05-2024 03:22

Target

0f8ee1ed415794ec053dca928a409436_JaffaCakes118.dll
Size

166KB
MD5

0f8ee1ed415794ec053dca928a409436
SHA1

816810ed34af4cb460c36b76b6dc614be05b4d99
SHA256

6f6d4f3090669a12b7870d959302181d721436520374a4115e6c7bcfbc21cfef
SHA512

4ad3f0bdaf1121612b102e871ae12562fe765d00e3ab3cc77ee773c78a09cc8c9ebfeaabb15dde38a2df2f73be2338b93028d95ca003bd39556f1190f6108727
SSDEEP

3072:JLFrb30BRtBZZg+i2ayyYOCWGPyLydrkxMT3Q42wWIF:NJ0BXScFyfC3Hd4yg42RI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 936	2352	rundll32.exe	28
PID 2352 wrote to memory of 936	2352	rundll32.exe	28
PID 2352 wrote to memory of 936	2352	rundll32.exe	28
PID 2352 wrote to memory of 936	2352	rundll32.exe	28
PID 2352 wrote to memory of 936	2352	rundll32.exe	28
PID 2352 wrote to memory of 936	2352	rundll32.exe	28
PID 2352 wrote to memory of 936	2352	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f8ee1ed415794ec053dca928a409436_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f8ee1ed415794ec053dca928a409436_JaffaCakes118.dll,#1
  2⤵
  PID:936

memory/936-0-0x0000000000180000-0x000000000018A000-memory.dmp

Filesize
40KB

Download
memory/936-1-0x0000000002C50000-0x0000000002D19000-memory.dmp

Filesize
804KB

Download
memory/936-6-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/936-4-0x0000000000370000-0x000000000038F000-memory.dmp

Filesize
124KB

Download
memory/936-3-0x0000000003570000-0x000000000369D000-memory.dmp

Filesize
1.2MB

Download
memory/936-11-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/936-10-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/936-9-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/936-8-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/936-2-0x0000000002D20000-0x0000000002DBF000-memory.dmp

Filesize
636KB

Download
memory/936-5-0x0000000003930000-0x0000000003A39000-memory.dmp

Filesize
1.0MB

Download