57693a385b7c6ef65fb1bba9bcf6a9409b93c120085dac9c6028f873311ac132

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 07:22

Target

03fceff78ba4c7a57ee219d405c2d1a0_JaffaCakes118.dll
Size

14KB
MD5

03fceff78ba4c7a57ee219d405c2d1a0
SHA1

09f492da7dd002a8d754849d8212b462537de836
SHA256

57693a385b7c6ef65fb1bba9bcf6a9409b93c120085dac9c6028f873311ac132
SHA512

0e9538998b4d15de03df00cc3dd9637ac9f5456633396ea7dedc6aa0d03eadc45b06b11b4368e12cdb14cc7ceb0f92f70c705f0ae58d5a308629158eebd208fd
SSDEEP

192:BQuhaqSzfSMreYIxz7rL3fLuBXYTnH8IzOhVV9Uu4XrNoXGLScblZEPmlY+kihyR:BGTIdnuBoDCeX+WG+rlY+yNe1Wr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\03fceff78ba4c7a57ee219d405c2d1a0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\03fceff78ba4c7a57ee219d405c2d1a0_JaffaCakes118.dll,#1
  2⤵
  PID:2160

memory/2160-0-0x0000000075200000-0x000000007520C000-memory.dmp

Filesize
48KB

Download