75272ca1c978d17044632ff35c104311219d4076a8ee37c4e9a2fff5f298a4fa

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 17:32

Target

eb9e0f3739941a967efc85e3eb556e6a_JaffaCakes118.dll
Size

33KB
MD5

eb9e0f3739941a967efc85e3eb556e6a
SHA1

8658b0e40285bbdb21ec71261af856548e25d960
SHA256

75272ca1c978d17044632ff35c104311219d4076a8ee37c4e9a2fff5f298a4fa
SHA512

9a276c6c8405db741d19471df05583db4f3f55e4a9ffb5e2b2538d2923cacf518e62c9ea57e89f6fa3254e0a90bc05b1fc4da6368382df69b7c6bdb091b86a3f
SSDEEP

768:U8pjghrK5eEOyzNqi9UHjA7Vsc7vHFT35hcDCsjpRZd/aI:U8pjarK5eNH8X7vlTpCusjpRz/5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2824	1948	rundll32.exe	28
PID 1948 wrote to memory of 2824	1948	rundll32.exe	28
PID 1948 wrote to memory of 2824	1948	rundll32.exe	28
PID 1948 wrote to memory of 2824	1948	rundll32.exe	28
PID 1948 wrote to memory of 2824	1948	rundll32.exe	28
PID 1948 wrote to memory of 2824	1948	rundll32.exe	28
PID 1948 wrote to memory of 2824	1948	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb9e0f3739941a967efc85e3eb556e6a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb9e0f3739941a967efc85e3eb556e6a_JaffaCakes118.dll,#1
  2⤵
  PID:2824