65c32a6227481808d11786d913de783090b984023b9455bbfdecdec9ab842fad

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 13:35

Target

f39a18f3dc2ae9f32e259829a48316a7_JaffaCakes118.dll
Size

15KB
MD5

f39a18f3dc2ae9f32e259829a48316a7
SHA1

8fd115817a023f9719bfd1a657ebedb143303f00
SHA256

65c32a6227481808d11786d913de783090b984023b9455bbfdecdec9ab842fad
SHA512

2d52a42ba7aaa76a8130495a75177c7a736baacfaff12c52d7a625d568884036862beedc7c08fba759d7d00d1bbaf3d91f170f54c7ce2f2ed9337caafa101bb7
SSDEEP

192:um7qFcve/C7wFz1QTUcoRFbMIWcvmGI6iOIWcBY7DHCR3qIW9hqKBZHkMeRKR:um7qmGM6sU9fWCxQWQzR39W7q4hcKR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2928	3048	rundll32.exe	28
PID 3048 wrote to memory of 2928	3048	rundll32.exe	28
PID 3048 wrote to memory of 2928	3048	rundll32.exe	28
PID 3048 wrote to memory of 2928	3048	rundll32.exe	28
PID 3048 wrote to memory of 2928	3048	rundll32.exe	28
PID 3048 wrote to memory of 2928	3048	rundll32.exe	28
PID 3048 wrote to memory of 2928	3048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f39a18f3dc2ae9f32e259829a48316a7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f39a18f3dc2ae9f32e259829a48316a7_JaffaCakes118.dll,#1
  2⤵
  PID:2928