9d073c33072435e03e4b370d27c61b06ac3bc71eee5741244bc689dbb13ede44

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 12:39

Target

f1132ef5914e6c51c4076fcaffed90a0_JaffaCakes118.dll
Size

6KB
MD5

f1132ef5914e6c51c4076fcaffed90a0
SHA1

5eb115983caf142b0739da21c6e67f05a9c371b3
SHA256

9d073c33072435e03e4b370d27c61b06ac3bc71eee5741244bc689dbb13ede44
SHA512

b172f50871575b673829f936004f6007fab94a8f8abc3b910a4ae399809e1be7727d0d5ec7f4b3dc79b011d1747f582d32b0abe68cfef128a84335a0061843b2
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG0HB+BDq9J5SC:8qtV0HAr4uB+FqX5SC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2184	2092	rundll32.exe	28
PID 2092 wrote to memory of 2184	2092	rundll32.exe	28
PID 2092 wrote to memory of 2184	2092	rundll32.exe	28
PID 2092 wrote to memory of 2184	2092	rundll32.exe	28
PID 2092 wrote to memory of 2184	2092	rundll32.exe	28
PID 2092 wrote to memory of 2184	2092	rundll32.exe	28
PID 2092 wrote to memory of 2184	2092	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1132ef5914e6c51c4076fcaffed90a0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1132ef5914e6c51c4076fcaffed90a0_JaffaCakes118.dll,#1
  2⤵
  PID:2184