69cfca1f7b667be175e55dc1ff3818aebd8c395058e03a761c19fb800c3de084

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 16:16

Target

f854cc1717409b3355d9fdcbeb96e353_JaffaCakes118.dll
Size

57KB
MD5

f854cc1717409b3355d9fdcbeb96e353
SHA1

e29d2f979f26394f8a22bd84daf9585f71edaa84
SHA256

69cfca1f7b667be175e55dc1ff3818aebd8c395058e03a761c19fb800c3de084
SHA512

680470af8181e2eee65e3048e31110bda6c87af53608394edfb7f0b72eda1c286361035f0f042dd43ed04e4ddef599f64821eb33fb4cea0c7a4b4d81adb91345
SSDEEP

1536:1zExMwCGQ2jBszosbXcmw4SATvfd5nzqqDpa0Glne7i/e6cx4MTk:1I+wCGv0s94ZvFRA0Gle7csJk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2276	2824	rundll32.exe	28
PID 2824 wrote to memory of 2276	2824	rundll32.exe	28
PID 2824 wrote to memory of 2276	2824	rundll32.exe	28
PID 2824 wrote to memory of 2276	2824	rundll32.exe	28
PID 2824 wrote to memory of 2276	2824	rundll32.exe	28
PID 2824 wrote to memory of 2276	2824	rundll32.exe	28
PID 2824 wrote to memory of 2276	2824	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f854cc1717409b3355d9fdcbeb96e353_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f854cc1717409b3355d9fdcbeb96e353_JaffaCakes118.dll,#1
  2⤵
  PID:2276