e96c973687560ef20fe9cc952e0c13de79c4b8b11c2bec2722f73529aedaf3a4

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 05:51

Target

f9a2d4f78b80b6e3d7f9b633124ef3da_JaffaCakes118.dll
Size

5KB
MD5

f9a2d4f78b80b6e3d7f9b633124ef3da
SHA1

b7f666a93f277a53d1f6b168469c20c036d10cbb
SHA256

e96c973687560ef20fe9cc952e0c13de79c4b8b11c2bec2722f73529aedaf3a4
SHA512

575890d1b2182423ca960db896e88b3aff33b0f7e41fd2a6dffba7707192478bb4e516d08a0248a7fed04c16f9fb7426bf6cfd720a9cd8187d0e1d1ea9efc458
SSDEEP

96:RhpDi6iiGIaXowjJj8KE7milmQ1k6GsvvV0DB5UVMecB7w6RsmUzpBZBH:Rb+a1eSK+VSDcmFQm4pp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1880	2208	rundll32.exe	28
PID 2208 wrote to memory of 1880	2208	rundll32.exe	28
PID 2208 wrote to memory of 1880	2208	rundll32.exe	28
PID 2208 wrote to memory of 1880	2208	rundll32.exe	28
PID 2208 wrote to memory of 1880	2208	rundll32.exe	28
PID 2208 wrote to memory of 1880	2208	rundll32.exe	28
PID 2208 wrote to memory of 1880	2208	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9a2d4f78b80b6e3d7f9b633124ef3da_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9a2d4f78b80b6e3d7f9b633124ef3da_JaffaCakes118.dll,#1
  2⤵
  PID:1880