05e911dfc0f644b9bf90f0ca6686784fa4ed9d6f6db119129408f99761df246f

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 15:38

Target

fa9e845afd7952aba059e766b0c61bbd_JaffaCakes118.dll
Size

650KB
MD5

fa9e845afd7952aba059e766b0c61bbd
SHA1

8b21b536f489134ada957809e09589741fde5f9d
SHA256

05e911dfc0f644b9bf90f0ca6686784fa4ed9d6f6db119129408f99761df246f
SHA512

d96adeb16cb709d50414a952ab78a098c2753dd45897cfee5d9c107a4cd66fe7bbc1f8095a7b6f832fe3bd177868f0ebffeaf88e5e55da17da38f2ea43c1efdd
SSDEEP

12288:bCo9lUzOvdYImmWE2h/eWtBvmfDRUvqWECYQMFNun8l3VcQSc:h9l5mmWEG/eWPvmfDRUvwNQMFNu8l3Vx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2992	2928	rundll32.exe	28
PID 2928 wrote to memory of 2992	2928	rundll32.exe	28
PID 2928 wrote to memory of 2992	2928	rundll32.exe	28
PID 2928 wrote to memory of 2992	2928	rundll32.exe	28
PID 2928 wrote to memory of 2992	2928	rundll32.exe	28
PID 2928 wrote to memory of 2992	2928	rundll32.exe	28
PID 2928 wrote to memory of 2992	2928	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa9e845afd7952aba059e766b0c61bbd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa9e845afd7952aba059e766b0c61bbd_JaffaCakes118.dll,#1
  2⤵
  PID:2992