bd2db5c0ebd0db49e6e6142861164008a7b899af0e484ef55da49848d887978b

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 06:43

Target

f9ba605c71b3dacacdd4cfc2d561721c_JaffaCakes118.dll
Size

6KB
MD5

f9ba605c71b3dacacdd4cfc2d561721c
SHA1

ec504557de1705b2c3b9e6bac1132c6150cda185
SHA256

bd2db5c0ebd0db49e6e6142861164008a7b899af0e484ef55da49848d887978b
SHA512

ff4f2bf4db6a29392ed9fc93e092d297432d19f3a009e6d207616588f4d5d19727e9a86be7c8784ad296ae1896fd716c093a4a40e5a2e03684fe47db91bd634a
SSDEEP

48:6AA35YVOQDV8FszwydlAYsLFV3G0wB+BDq9J5S2:0QDV8FscMjsLFV3IB+FqX5S2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2764	2084	rundll32.exe	28
PID 2084 wrote to memory of 2764	2084	rundll32.exe	28
PID 2084 wrote to memory of 2764	2084	rundll32.exe	28
PID 2084 wrote to memory of 2764	2084	rundll32.exe	28
PID 2084 wrote to memory of 2764	2084	rundll32.exe	28
PID 2084 wrote to memory of 2764	2084	rundll32.exe	28
PID 2084 wrote to memory of 2764	2084	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9ba605c71b3dacacdd4cfc2d561721c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9ba605c71b3dacacdd4cfc2d561721c_JaffaCakes118.dll,#1
  2⤵
  PID:2764