c01754436094802ccc48035a8679bf1f681ed6b20eb16a27cb796ba15eb8f628

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 03:12

Target

0c3b8e974e0bb8c6f185e4e6574c69e6_JaffaCakes118.dll
Size

117KB
MD5

0c3b8e974e0bb8c6f185e4e6574c69e6
SHA1

6fef9d2f5cf2e2b720cf7dd9c91dece3978d4294
SHA256

c01754436094802ccc48035a8679bf1f681ed6b20eb16a27cb796ba15eb8f628
SHA512

ea5559c58b3f663d3524c499e5c2ba4a866acea9ce4d0b75a4215d1d218c9f4ba191a093154f9ca56f89ee13ac097790bfc2148d83a93b9814fbe3dd4a601147
SSDEEP

3072:NiA9nEuBFV1kxtMmsF4LlPBHapqJbCTEhzOX0SkM2Qro7QyjQLxovpT/n60IEt:nE0msuL1UqzQro7QyjQypbT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2168	2996	rundll32.exe	28
PID 2996 wrote to memory of 2168	2996	rundll32.exe	28
PID 2996 wrote to memory of 2168	2996	rundll32.exe	28
PID 2996 wrote to memory of 2168	2996	rundll32.exe	28
PID 2996 wrote to memory of 2168	2996	rundll32.exe	28
PID 2996 wrote to memory of 2168	2996	rundll32.exe	28
PID 2996 wrote to memory of 2168	2996	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c3b8e974e0bb8c6f185e4e6574c69e6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c3b8e974e0bb8c6f185e4e6574c69e6_JaffaCakes118.dll,#1
  2⤵
  PID:2168

memory/2168-1-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2168-0-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download