308e8b21d82e40ac510eb23c9f45658b53b6eba3d87912eb69a477fd730b7fc5

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 23:31

Target

f491ace1bfd4df2f6e9f64f004a516e0_JaffaCakes118.dll
Size

496KB
MD5

f491ace1bfd4df2f6e9f64f004a516e0
SHA1

a0db93a29ac928289e13f0910ddb4da28a7086af
SHA256

308e8b21d82e40ac510eb23c9f45658b53b6eba3d87912eb69a477fd730b7fc5
SHA512

04ddb0fc714b6670333a1fc08f1e0abc0940e551c3b02b09275d306115fd1b9acf71b3fa7d9ca02585ebdc427ef7452bf9e1bed573fad9e53c0adf696de3f231
SSDEEP

12288:5FoSETwnfonTb+1bi/gAnlsNf9u59lUK8Xo5Uu+WYMKN:znfATAi/gWu9uv7uo7XYTN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1900	1700	rundll32.exe	28
PID 1700 wrote to memory of 1900	1700	rundll32.exe	28
PID 1700 wrote to memory of 1900	1700	rundll32.exe	28
PID 1700 wrote to memory of 1900	1700	rundll32.exe	28
PID 1700 wrote to memory of 1900	1700	rundll32.exe	28
PID 1700 wrote to memory of 1900	1700	rundll32.exe	28
PID 1700 wrote to memory of 1900	1700	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f491ace1bfd4df2f6e9f64f004a516e0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f491ace1bfd4df2f6e9f64f004a516e0_JaffaCakes118.dll,#1
  2⤵
  PID:1900