e9a900ff03a913f2c9df6cffd84777bfac154b5eb197174f154158250ce0ed6f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 14:19

Target

e2ba395530c56e5099a7713899ce53f9_JaffaCakes118.dll
Size

248KB
MD5

e2ba395530c56e5099a7713899ce53f9
SHA1

98fe60661ca73e6463ba6442a86990a6d43a5393
SHA256

e9a900ff03a913f2c9df6cffd84777bfac154b5eb197174f154158250ce0ed6f
SHA512

32bf80e8a44eec1aeefefe5d2cb7356b2c6d4f19069e9c5cba292c3d704d3e974ae4c7416a438471137e42caed5a0536bcfcd947d73bf03d342883f5abc312a4
SSDEEP

6144:K9UYwV1Ec/BnAiWjInQeeaQeeWZQeesQeeMcQeehQeewhDEVtpP2qyMssQ:K9UYwLZBn5BDeLyZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2304	2240	rundll32.exe	28
PID 2240 wrote to memory of 2304	2240	rundll32.exe	28
PID 2240 wrote to memory of 2304	2240	rundll32.exe	28
PID 2240 wrote to memory of 2304	2240	rundll32.exe	28
PID 2240 wrote to memory of 2304	2240	rundll32.exe	28
PID 2240 wrote to memory of 2304	2240	rundll32.exe	28
PID 2240 wrote to memory of 2304	2240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2ba395530c56e5099a7713899ce53f9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2ba395530c56e5099a7713899ce53f9_JaffaCakes118.dll,#1
  2⤵
  PID:2304