6102aaf68ad4aac7a1452192d5c65899ee1c903aab84bf13fa89b60d6f98b80c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 21:39

Target

f6a099fcd760bb22ce617e7348d508ab_JaffaCakes118.dll
Size

35KB
MD5

f6a099fcd760bb22ce617e7348d508ab
SHA1

950d52413987599239e9a88c8e7cdd47c32046af
SHA256

6102aaf68ad4aac7a1452192d5c65899ee1c903aab84bf13fa89b60d6f98b80c
SHA512

ce5b5eb3a0c4f53bafe11236b2c6b58712f45853849019439bacbeb08fa4b06195d38ec31682cd24bbb0454cd21505559d06c2140496a3df8d99e0f49dbf799d
SSDEEP

768:NPfBvZHWGwuT+dnls7QQnXbJgv3/CODbEiRVcLe:xBv7T+B67QCXbJgv6OEiRGi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1992	1740	rundll32.exe	28
PID 1740 wrote to memory of 1992	1740	rundll32.exe	28
PID 1740 wrote to memory of 1992	1740	rundll32.exe	28
PID 1740 wrote to memory of 1992	1740	rundll32.exe	28
PID 1740 wrote to memory of 1992	1740	rundll32.exe	28
PID 1740 wrote to memory of 1992	1740	rundll32.exe	28
PID 1740 wrote to memory of 1992	1740	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6a099fcd760bb22ce617e7348d508ab_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6a099fcd760bb22ce617e7348d508ab_JaffaCakes118.dll,#1
  2⤵
  PID:1992