1bc6fbd34658f5e06533731c00779a368b6555c607ae6bac2aa2b8eb70d143f1

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 00:17

Target

23fabdf5ea2de6a347d01417fc9d7f8a_JaffaCakes118.dll
Size

194KB
MD5

23fabdf5ea2de6a347d01417fc9d7f8a
SHA1

429d045690302d300e3b5ba0e85473c74fdd0336
SHA256

1bc6fbd34658f5e06533731c00779a368b6555c607ae6bac2aa2b8eb70d143f1
SHA512

b7f023f75f412427019d07f5d06d7592a055ec8dfd59d3b1a28b094803b4d0cc77718cd3aba7a536c1c856d55b063d6f6fbf7250e839f99e57ade6c84d2983f8
SSDEEP

3072:G0qrXTDm4YlPLe9321DhYc7qZsNcNhQALH9sl0ZK+oIAsoq1:G3rDy4l9eDRqZV4qdsl0/omV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23fabdf5ea2de6a347d01417fc9d7f8a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23fabdf5ea2de6a347d01417fc9d7f8a_JaffaCakes118.dll,#1
  2⤵
  PID:2052

memory/2052-0-0x0000000000406000-0x0000000000409000-memory.dmp

Filesize
12KB

Download
memory/2052-1-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download