69acd2f9a4e78d30b54e6fcbc6ec10befb17e72822bfa032bf1cdc277f74c4a4

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 09:20

Target

e9a9b8191ba607771f59023be4ab1307_JaffaCakes118.dll
Size

92KB
MD5

e9a9b8191ba607771f59023be4ab1307
SHA1

93be94c063c499018298b533a51944be49c7d361
SHA256

69acd2f9a4e78d30b54e6fcbc6ec10befb17e72822bfa032bf1cdc277f74c4a4
SHA512

13c7ee711e164976b3bcebb40b8c913e0e850264030209e6f9b6a4f56e201ac64628b41933b36828c8eaf1e6c33a0e5a55a7d1e60f2596d8af6462ddad231407
SSDEEP

1536:d3i1qZQeX+4uv3pxt70R+Z0Pf6oc7UA7pk8AEgRiaN:XXjEl0RMUCocIA768pg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1708	2224	rundll32.exe	28
PID 2224 wrote to memory of 1708	2224	rundll32.exe	28
PID 2224 wrote to memory of 1708	2224	rundll32.exe	28
PID 2224 wrote to memory of 1708	2224	rundll32.exe	28
PID 2224 wrote to memory of 1708	2224	rundll32.exe	28
PID 2224 wrote to memory of 1708	2224	rundll32.exe	28
PID 2224 wrote to memory of 1708	2224	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9a9b8191ba607771f59023be4ab1307_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9a9b8191ba607771f59023be4ab1307_JaffaCakes118.dll,#1
  2⤵
  PID:1708