5c9b8f7a683fc3b8b8d6986b0df9f9d6b0bbc2e80a8de64ace28eed9f7ecf452

Analysis

max time kernel
117s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 06:53

Target

de1f671eda3324db99fc3f1ae90b6620_JaffaCakes118.dll
Size

4.0MB
MD5

de1f671eda3324db99fc3f1ae90b6620
SHA1

af5f67a406e997d1f1ab2234d294c77d63eedb85
SHA256

5c9b8f7a683fc3b8b8d6986b0df9f9d6b0bbc2e80a8de64ace28eed9f7ecf452
SHA512

62946fe9fb3223c658cd6fc2343d4a7310543abee84bcfb6965bdb453531a89e92fe023fc643317f561dc7f103eb653435e16e822feeda8a004dd4dddb4255f2
SSDEEP

98304:8566l2u45UNYFrkvz29kdJWk566l2u45UNYFrkvz29kdJW:06w2u45UNSwvz1JWM6w2u45UNSwvz1JW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1584	2944	rundll32.exe	28
PID 2944 wrote to memory of 1584	2944	rundll32.exe	28
PID 2944 wrote to memory of 1584	2944	rundll32.exe	28
PID 2944 wrote to memory of 1584	2944	rundll32.exe	28
PID 2944 wrote to memory of 1584	2944	rundll32.exe	28
PID 2944 wrote to memory of 1584	2944	rundll32.exe	28
PID 2944 wrote to memory of 1584	2944	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de1f671eda3324db99fc3f1ae90b6620_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de1f671eda3324db99fc3f1ae90b6620_JaffaCakes118.dll,#1
  2⤵
  PID:1584