b9dc921767c34b867e5109e4a5ebb1326adf81ff0a8705b3382de30cfc4fd676

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 09:01

Target

f56d18c5101f85c509b865e53dc87fd6_JaffaCakes118.dll
Size

5KB
MD5

f56d18c5101f85c509b865e53dc87fd6
SHA1

d7aa391da4b49df316abba9fbb6ac33a0b9caa83
SHA256

b9dc921767c34b867e5109e4a5ebb1326adf81ff0a8705b3382de30cfc4fd676
SHA512

b15d24431f9d01d6a089b2af41453e62773b9d577c090dffb0d84d95cd633b13b402e1a8e7c3b66430da97df6549e989316c44a053568d6879713aa87d1c4468
SSDEEP

48:iCXTvABVemcnhgOnpT75B6Pm6e8rzYySCXcRqklhWsC4XuvcQ:/ccnhgO15u5jrzYmsokKsCRcQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2376	1044	rundll32.exe	28
PID 1044 wrote to memory of 2376	1044	rundll32.exe	28
PID 1044 wrote to memory of 2376	1044	rundll32.exe	28
PID 1044 wrote to memory of 2376	1044	rundll32.exe	28
PID 1044 wrote to memory of 2376	1044	rundll32.exe	28
PID 1044 wrote to memory of 2376	1044	rundll32.exe	28
PID 1044 wrote to memory of 2376	1044	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f56d18c5101f85c509b865e53dc87fd6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f56d18c5101f85c509b865e53dc87fd6_JaffaCakes118.dll,#1
  2⤵
  PID:2376