781a65b2c63442a5670c0afea8fd3100fb39442d783604606c1d3f58196e7f19

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 14:53

Target

f6075f1b0942d37bdb2b8bb57266cf31_JaffaCakes118.dll
Size

64KB
MD5

f6075f1b0942d37bdb2b8bb57266cf31
SHA1

7c0bc2bffe2060bbad4f645c846d8fde98d79631
SHA256

781a65b2c63442a5670c0afea8fd3100fb39442d783604606c1d3f58196e7f19
SHA512

4592f6b215281bc676013d6caef21f9f590d2b27d1df6c8b4377e7c4cb62b65255f50222817db56f3d9e51d7c7bb3c659cacc9df73d8d50379d57aa70cafe076
SSDEEP

768:nHLEjXqOcy48wA+LkoqW8lyTxkw9U2p26wbzC5sdxMjiB9UQgwWHiGOs3qB:nWaC+Ltq1lyTCM8nzN4los6B

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2492	2780	rundll32.exe	28
PID 2780 wrote to memory of 2492	2780	rundll32.exe	28
PID 2780 wrote to memory of 2492	2780	rundll32.exe	28
PID 2780 wrote to memory of 2492	2780	rundll32.exe	28
PID 2780 wrote to memory of 2492	2780	rundll32.exe	28
PID 2780 wrote to memory of 2492	2780	rundll32.exe	28
PID 2780 wrote to memory of 2492	2780	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6075f1b0942d37bdb2b8bb57266cf31_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6075f1b0942d37bdb2b8bb57266cf31_JaffaCakes118.dll,#1
  2⤵
  PID:2492