6e3a964156d30e390726574ac9525dc7583e5e4e4cfa8342b64c11bc6a4b4ef0

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 10:43

Target

f0de7654705e3f2a867b2d04152998e5_JaffaCakes118.dll
Size

32KB
MD5

f0de7654705e3f2a867b2d04152998e5
SHA1

5b74c6bbd0fdeda0260895950bab42effba1dd57
SHA256

6e3a964156d30e390726574ac9525dc7583e5e4e4cfa8342b64c11bc6a4b4ef0
SHA512

ce7b53514d850eb7bbc7f67a74ed6ed244b90322aae704dab2ea07fa7094b26423421e8e731be9e3766745daa27a1b41e5b44f7fec7cdf0df2f27cfc97b1b0a9
SSDEEP

384:AUIsK3EA9NMG5YBPUi9MY9zoDpb77+/VZSXGQG9aFJFrWCRIFs1p:ssKUTeos4MY9zqb7QZkGZ96BTRIO1p

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2968	2872	rundll32.exe	28
PID 2872 wrote to memory of 2968	2872	rundll32.exe	28
PID 2872 wrote to memory of 2968	2872	rundll32.exe	28
PID 2872 wrote to memory of 2968	2872	rundll32.exe	28
PID 2872 wrote to memory of 2968	2872	rundll32.exe	28
PID 2872 wrote to memory of 2968	2872	rundll32.exe	28
PID 2872 wrote to memory of 2968	2872	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0de7654705e3f2a867b2d04152998e5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0de7654705e3f2a867b2d04152998e5_JaffaCakes118.dll,#1
  2⤵
  PID:2968