d1b3aeb5f9d28efc0d3aeaea48f17259a07cbb4b83d90798ecacd19788c0fa2d

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 17:57

Target

f87bfc0e8638be36d05610de2ad42de9_JaffaCakes118.dll
Size

94KB
MD5

f87bfc0e8638be36d05610de2ad42de9
SHA1

2a077327e70a7936cbc7825bf8371055d3550e37
SHA256

d1b3aeb5f9d28efc0d3aeaea48f17259a07cbb4b83d90798ecacd19788c0fa2d
SHA512

828d9dc6f1f8e83d17713a073e0955912bd48a040570e5f40340571c4219de0d5242bb8467a3df0e75fe68e0e64537f32ce8e4b5b8d6558c3495e0a394759c09
SSDEEP

1536:KsWGHeLBAjdqPd0xnhBbgA6UBeiFT01/GCJznDYAGt1Gy/t1FSthqbKDpYP1hR9/:FWHokOVheHZGCdnchXTKDePHHIBq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2516	2060	rundll32.exe	28
PID 2060 wrote to memory of 2516	2060	rundll32.exe	28
PID 2060 wrote to memory of 2516	2060	rundll32.exe	28
PID 2060 wrote to memory of 2516	2060	rundll32.exe	28
PID 2060 wrote to memory of 2516	2060	rundll32.exe	28
PID 2060 wrote to memory of 2516	2060	rundll32.exe	28
PID 2060 wrote to memory of 2516	2060	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f87bfc0e8638be36d05610de2ad42de9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f87bfc0e8638be36d05610de2ad42de9_JaffaCakes118.dll,#1
  2⤵
  PID:2516