02f128881f7c2875605f8ca16e60ea338a4a4338ad49b6e64c2e555cea7ea4db

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 05:35

Target

e956b19e5d9deab0524252497a20f742_JaffaCakes118.dll
Size

64KB
MD5

e956b19e5d9deab0524252497a20f742
SHA1

f4ec96ddb7c0a4fe8297eb9b15df2da814268965
SHA256

02f128881f7c2875605f8ca16e60ea338a4a4338ad49b6e64c2e555cea7ea4db
SHA512

c1381dbd51ef25c587a91a2b4941c1e9e217c8c97f79a6fdf363ea15a3abab51240043fdff1754887d2e653f1f15c8dc3b88786138d453a7b76e354211318dcd
SSDEEP

768:7HLEjXqOcy48wA+LkoqW8lyTxkw9U2p26wbzC5sdxMjiB9UQgwWHiGOs3qU:7WaC+Ltq1lyTCM8nzN4los6U

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2316	2064	rundll32.exe	28
PID 2064 wrote to memory of 2316	2064	rundll32.exe	28
PID 2064 wrote to memory of 2316	2064	rundll32.exe	28
PID 2064 wrote to memory of 2316	2064	rundll32.exe	28
PID 2064 wrote to memory of 2316	2064	rundll32.exe	28
PID 2064 wrote to memory of 2316	2064	rundll32.exe	28
PID 2064 wrote to memory of 2316	2064	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e956b19e5d9deab0524252497a20f742_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e956b19e5d9deab0524252497a20f742_JaffaCakes118.dll,#1
  2⤵
  PID:2316