657adc00fe44bf0c74e18964bae6443370b7744f1315a32f36970e652b7aa4cf

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 06:03

Target

ecd135136c883cfa40e7f95e58f5264e_JaffaCakes118.dll
Size

135KB
MD5

ecd135136c883cfa40e7f95e58f5264e
SHA1

ec64017ec4030c939bbeca43de9affa341328988
SHA256

657adc00fe44bf0c74e18964bae6443370b7744f1315a32f36970e652b7aa4cf
SHA512

d95d48d49a1b85e503f78bd00cca1bf13d366a235a2621238decb209f5336ef883037d81aaaa17aa8efdc79715eb8baad7c7d2717472387a63da4f274492836c
SSDEEP

1536:nuSM379pilzy4aCUBGbrufhif3ba/Qtps4zWeYXuOtMl+:nu79WdaC2urufq33UeYuOP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecd135136c883cfa40e7f95e58f5264e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecd135136c883cfa40e7f95e58f5264e_JaffaCakes118.dll,#1
  2⤵
  PID:2004