f9b88defe7fa825eadd2e4c8503bf172158ff5dd41c9a19a9ac5fee4cc19b66e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 08:18

Target

196d05660e5cbe352220b39e38bf00c8_JaffaCakes118.dll
Size

144KB
MD5

196d05660e5cbe352220b39e38bf00c8
SHA1

6850760cdb6a9f206b4d0909157e64fa518fc662
SHA256

f9b88defe7fa825eadd2e4c8503bf172158ff5dd41c9a19a9ac5fee4cc19b66e
SHA512

67defed46a5e89401f8298816e7d39e1e30a0f845004ca6c7f11e0c34f237fccd60ba1768827f33bcfda44b907e8fbb3672b6c5b9c45fc6935e15c4932a5007c
SSDEEP

3072:ZDf8Z9Uq7Vyfv8c+ZOwLLNo2p+O2fJyEiji8lOZ9tI:xeU9GOeBo2ENxyEaIZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1752	1688	rundll32.exe	28
PID 1688 wrote to memory of 1752	1688	rundll32.exe	28
PID 1688 wrote to memory of 1752	1688	rundll32.exe	28
PID 1688 wrote to memory of 1752	1688	rundll32.exe	28
PID 1688 wrote to memory of 1752	1688	rundll32.exe	28
PID 1688 wrote to memory of 1752	1688	rundll32.exe	28
PID 1688 wrote to memory of 1752	1688	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\196d05660e5cbe352220b39e38bf00c8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\196d05660e5cbe352220b39e38bf00c8_JaffaCakes118.dll,#1
  2⤵
  PID:1752

memory/1752-2-0x0000000010000000-0x0000000010067000-memory.dmp

Filesize
412KB

Download
memory/1752-1-0x0000000010000000-0x0000000010067000-memory.dmp

Filesize
412KB

Download
memory/1752-0-0x0000000010000000-0x0000000010067000-memory.dmp

Filesize
412KB

Download