6ade3de5683e919eccbad9004dbebdbac56e056e5c8ba34c047486b1cd221cde

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 10:23

Target

e9c6a23ce032ab05c258d5bc7c3d0c09_JaffaCakes118.dll
Size

237KB
MD5

e9c6a23ce032ab05c258d5bc7c3d0c09
SHA1

6ab74fd863fc23018f55c922926e9f86cb4692c0
SHA256

6ade3de5683e919eccbad9004dbebdbac56e056e5c8ba34c047486b1cd221cde
SHA512

8b2bd14d48cd308856a7321c0ee06ec207dca1a6ab388b16a9a0340a8cadfe4749b5e4624f36f85b0afc5055da2d2f24133ca7ee84f47a515feff1e13b2e4b86
SSDEEP

6144:Amltx/EGUY+QYEnnaQeeaQeekQeesQee4jQeehQeee/sNVNzaYSMesy:AgDEGUYC0sNa/d

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9c6a23ce032ab05c258d5bc7c3d0c09_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9c6a23ce032ab05c258d5bc7c3d0c09_JaffaCakes118.dll,#1
  2⤵
  PID:2932