2c8616f3e613e5d2da67c6a2be44b6b6e91215f5bd5c8ebf7bd32629e1397488

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 10:16

Target

0db0da78ec83568841b5087b06ea7d2b_JaffaCakes118.dll
Size

100KB
MD5

0db0da78ec83568841b5087b06ea7d2b
SHA1

bbceccc2b36c399ef8b6018475c4f2cdc51c106c
SHA256

2c8616f3e613e5d2da67c6a2be44b6b6e91215f5bd5c8ebf7bd32629e1397488
SHA512

978b694e0de53427a5a63030458748bf7181bfd666ef4987b683d7501ed092a2341f52651bb22b55ed28cc973bd01ad5d9a385e46b40d1eccb7c009bf261469d
SSDEEP

3072:crfbRdt0ponOI2O/j8XQqGKxY0weLr7zb:chdt0poOhG3F0Z7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2192	3016	rundll32.exe	28
PID 3016 wrote to memory of 2192	3016	rundll32.exe	28
PID 3016 wrote to memory of 2192	3016	rundll32.exe	28
PID 3016 wrote to memory of 2192	3016	rundll32.exe	28
PID 3016 wrote to memory of 2192	3016	rundll32.exe	28
PID 3016 wrote to memory of 2192	3016	rundll32.exe	28
PID 3016 wrote to memory of 2192	3016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0db0da78ec83568841b5087b06ea7d2b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0db0da78ec83568841b5087b06ea7d2b_JaffaCakes118.dll,#1
  2⤵
  PID:2192

memory/2192-0-0x0000000000140000-0x000000000014D000-memory.dmp

Filesize
52KB

Download
memory/2192-1-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2192-6-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2192-5-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2192-7-0x0000000000140000-0x0000000000142000-memory.dmp

Filesize
8KB

Download