6c6d1c507d4043438a276f135fb56034dd30a590272fbe77859d507d9bf13d8a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 10:01

Target

e9bcec54ea3c207ec1fa831192826355_JaffaCakes118.dll
Size

16KB
MD5

e9bcec54ea3c207ec1fa831192826355
SHA1

6c6d86f5f7ed23f5fa8987ea1031e04abb9b284c
SHA256

6c6d1c507d4043438a276f135fb56034dd30a590272fbe77859d507d9bf13d8a
SHA512

bd4d59f28bab6ee6ef0f522b415b14f2b0b83da266a433f971b1c77d30d66cd4db9dc4a48a26420617010eee4accd12e7876b2046bb50449452abc5dd0d64e31
SSDEEP

384:yLm0Cliibf/hABTNQnfJ8OCjWBrkSCO11HAX0wJ8Ew:TvliHBMx8bbO1Tq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 1744	2936	rundll32.exe	28
PID 2936 wrote to memory of 1744	2936	rundll32.exe	28
PID 2936 wrote to memory of 1744	2936	rundll32.exe	28
PID 2936 wrote to memory of 1744	2936	rundll32.exe	28
PID 2936 wrote to memory of 1744	2936	rundll32.exe	28
PID 2936 wrote to memory of 1744	2936	rundll32.exe	28
PID 2936 wrote to memory of 1744	2936	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9bcec54ea3c207ec1fa831192826355_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9bcec54ea3c207ec1fa831192826355_JaffaCakes118.dll,#1
  2⤵
  PID:1744