d99cf11dec8c0e8204775ccc9090408ae10eacfd4ddbcbd32605b5580cf4f5a6

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 02:24

Target

f94c2fd16ba335b79576dbed77fd1a8e_JaffaCakes118.dll
Size

30KB
MD5

f94c2fd16ba335b79576dbed77fd1a8e
SHA1

482d99420581eee34c943c3be1ba734f5465c0b5
SHA256

d99cf11dec8c0e8204775ccc9090408ae10eacfd4ddbcbd32605b5580cf4f5a6
SHA512

be9c0ad64a5dfd3a3c6d7b833720a50968bc74af2db85cd2d17ebfaac8e54cdb6e1f47daaaa2b3b1cc908ed65dcf0bc1acd4ff07530f935935a9c32115ec914b
SSDEEP

384:DhiMKS5sT1Wzjm2ivSyaZYI1bI6fDpBsp1MVP7BoMiDpR2KA89nLdnXfUp0NaYM2:DuS5sBKy2ArARJJ7l2MibHvdvULYMfe

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1444	1732	rundll32.exe	28
PID 1732 wrote to memory of 1444	1732	rundll32.exe	28
PID 1732 wrote to memory of 1444	1732	rundll32.exe	28
PID 1732 wrote to memory of 1444	1732	rundll32.exe	28
PID 1732 wrote to memory of 1444	1732	rundll32.exe	28
PID 1732 wrote to memory of 1444	1732	rundll32.exe	28
PID 1732 wrote to memory of 1444	1732	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f94c2fd16ba335b79576dbed77fd1a8e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f94c2fd16ba335b79576dbed77fd1a8e_JaffaCakes118.dll,#1
  2⤵
  PID:1444