db8b1745aa1194c9538acd9241d1b998a551186f4724aca572275bdb23ccff54

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 09:45

Target

f3389177378084f781a0c4a9af41e985_JaffaCakes118.dll
Size

68KB
MD5

f3389177378084f781a0c4a9af41e985
SHA1

47e4c45ce812d167875f83e486cfa04112ca60a6
SHA256

db8b1745aa1194c9538acd9241d1b998a551186f4724aca572275bdb23ccff54
SHA512

97de7476cbfc379f1f2129169c21cc8acd2ca6508fe919fbf1a2bd403e210b80156b52d9dbcb250d4254e7652494a2f2f7f47d938ba22814900a1de4be8774c0
SSDEEP

768:fb9lE9x/tHCTn7BWJ2uBTbnCzwiVD39VY3VkoYF9l6JMCAPK9Zp7F:fhyN5+n7BI2uTwhy3VkjF9lR67F

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 2192	1092	rundll32.exe	28
PID 1092 wrote to memory of 2192	1092	rundll32.exe	28
PID 1092 wrote to memory of 2192	1092	rundll32.exe	28
PID 1092 wrote to memory of 2192	1092	rundll32.exe	28
PID 1092 wrote to memory of 2192	1092	rundll32.exe	28
PID 1092 wrote to memory of 2192	1092	rundll32.exe	28
PID 1092 wrote to memory of 2192	1092	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3389177378084f781a0c4a9af41e985_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3389177378084f781a0c4a9af41e985_JaffaCakes118.dll,#1
  2⤵
  PID:2192