54ff65cff262c7fdb68b42e3690e6e6f986b48c7a2c9ce1866aef70b52a331a6

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 07:35

Target

218d9f2cd78ca72ea7ed0ffe9e2dc67d_JaffaCakes118.dll
Size

201KB
MD5

218d9f2cd78ca72ea7ed0ffe9e2dc67d
SHA1

1142b3cf347e439eae6d0c90b6cde9797fed8e44
SHA256

54ff65cff262c7fdb68b42e3690e6e6f986b48c7a2c9ce1866aef70b52a331a6
SHA512

14372024fc3c71b9ceff52c847cf0867901b4a92098c6340367e12e0fa1df1f0119b339d2643eebb05630e599727584864ff2281b3ed2ec69085fa89ef76f8d2
SSDEEP

3072:nTRVnCuFuZUPj5QFpTF7RH+H21liYmrn70E8k/srsfhSWIDQDSIU3K:nTHCeGUPsr7Bc22Y+798k/Es2kT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2464	840	rundll32.exe	28
PID 840 wrote to memory of 2464	840	rundll32.exe	28
PID 840 wrote to memory of 2464	840	rundll32.exe	28
PID 840 wrote to memory of 2464	840	rundll32.exe	28
PID 840 wrote to memory of 2464	840	rundll32.exe	28
PID 840 wrote to memory of 2464	840	rundll32.exe	28
PID 840 wrote to memory of 2464	840	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\218d9f2cd78ca72ea7ed0ffe9e2dc67d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\218d9f2cd78ca72ea7ed0ffe9e2dc67d_JaffaCakes118.dll,#1
  2⤵
  PID:2464

memory/2464-0-0x0000000000560000-0x000000000057D000-memory.dmp

Filesize
116KB

Download
memory/2464-1-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download