e2b85a7365445a4c2a1d46dc2ad5ba38cd31eea2ba0ee485eedbe215695e106a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 14:13

Target

f1408154d45d780918adc1aa2664a39d_JaffaCakes118.dll
Size

11KB
MD5

f1408154d45d780918adc1aa2664a39d
SHA1

28ee57ae980644a5b0922a4cb746edb76fe28a84
SHA256

e2b85a7365445a4c2a1d46dc2ad5ba38cd31eea2ba0ee485eedbe215695e106a
SHA512

f33035a8086e9d87b2180834417d778a9f37efec479315383aee21304f06423344165c955eb8f577be46f137790974c38ffab53d501b8fa47a1eb98514ccee96
SSDEEP

192:4djoNSc57tNnE0eEdMKJCBHafMoAH8biCGDowHHPFBCiGhAzzN9qdHVrK0:IjR67tN1mKJuAMoU8biCQopi6DdHVf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2528	1752	rundll32.exe	28
PID 1752 wrote to memory of 2528	1752	rundll32.exe	28
PID 1752 wrote to memory of 2528	1752	rundll32.exe	28
PID 1752 wrote to memory of 2528	1752	rundll32.exe	28
PID 1752 wrote to memory of 2528	1752	rundll32.exe	28
PID 1752 wrote to memory of 2528	1752	rundll32.exe	28
PID 1752 wrote to memory of 2528	1752	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1408154d45d780918adc1aa2664a39d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1408154d45d780918adc1aa2664a39d_JaffaCakes118.dll,#1
  2⤵
  PID:2528