985f2b2a81e40e107bb25f026274d44f2bf123fd1ca142051f1c44f921c2a5e4

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
28-03-2024 21:53

Target

110cf4b4140ca6cddf45392ce7f2db65_JaffaCakes118.dll
Size

1.0MB
MD5

110cf4b4140ca6cddf45392ce7f2db65
SHA1

a8e65203c0a0d69d379d7de58ae32bf72b359efa
SHA256

985f2b2a81e40e107bb25f026274d44f2bf123fd1ca142051f1c44f921c2a5e4
SHA512

eafc4ddc2e1f47a7ddbaf4d86e155a78dd139a7469651d09e95305c3815edecd28a3e3720c61816fe52dfc709903ea2849e3622af40130cdc6181ef9624f1458
SSDEEP

24576:LU0QINf+2jAnRmoXPADkRKgiBSFHS3oaJQV7zBd4YeQm/09rA:LU0QIx+pnrXPADkRKgvHxDpz0YeQWor

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 1520	2984	rundll32.exe	28
PID 2984 wrote to memory of 1520	2984	rundll32.exe	28
PID 2984 wrote to memory of 1520	2984	rundll32.exe	28
PID 2984 wrote to memory of 1520	2984	rundll32.exe	28
PID 2984 wrote to memory of 1520	2984	rundll32.exe	28
PID 2984 wrote to memory of 1520	2984	rundll32.exe	28
PID 2984 wrote to memory of 1520	2984	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\110cf4b4140ca6cddf45392ce7f2db65_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\110cf4b4140ca6cddf45392ce7f2db65_JaffaCakes118.dll,#1
  2⤵
  PID:1520