ebbc41b1dac63179c47da1561a089bef27d0e23c914f5d00f33376a83a8b7eeb

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 15:46

Target

076c90e7b1a9eac0dbe1f103c9a374a5_JaffaCakes118.dll
Size

62KB
MD5

076c90e7b1a9eac0dbe1f103c9a374a5
SHA1

c78990c26154b780be5e79206655e38dbc622e7b
SHA256

ebbc41b1dac63179c47da1561a089bef27d0e23c914f5d00f33376a83a8b7eeb
SHA512

568d46805ed6dfc7b0eb91426de257a6ae6eb25d06e7e73b97d5c9cb70332c6ccfd2f06354897b63c27efe8ecf4be2af416d12f392bf8cb2b00456ffcf1b0273
SSDEEP

1536:apW0NI+TTQpbKSjEpHgJFUJ5Dwyk0Ez3EAZBKzlf:2XbTQVKSIpHKUJPk0Ez3EAZBKf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2164	2168	rundll32.exe	28
PID 2168 wrote to memory of 2164	2168	rundll32.exe	28
PID 2168 wrote to memory of 2164	2168	rundll32.exe	28
PID 2168 wrote to memory of 2164	2168	rundll32.exe	28
PID 2168 wrote to memory of 2164	2168	rundll32.exe	28
PID 2168 wrote to memory of 2164	2168	rundll32.exe	28
PID 2168 wrote to memory of 2164	2168	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\076c90e7b1a9eac0dbe1f103c9a374a5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\076c90e7b1a9eac0dbe1f103c9a374a5_JaffaCakes118.dll,#1
  2⤵
  PID:2164

memory/2164-3-0x0000000010035000-0x0000000010036000-memory.dmp

Filesize
4KB

Download
memory/2164-2-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/2164-1-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/2164-0-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download