0307ee096a52698de3cf3647b36692b328a0a590904faed72e02b071c2b4cd77

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 04:49

Target

fe7874ad0ef50befc50a92401f381ee8_JaffaCakes118.dll
Size

99KB
MD5

fe7874ad0ef50befc50a92401f381ee8
SHA1

7178999bbffac513949793be47b9812855b08748
SHA256

0307ee096a52698de3cf3647b36692b328a0a590904faed72e02b071c2b4cd77
SHA512

2af69f40199a72f7cdad8c143d0b8177d58e8aa026731b02405993975a1596ca25138c412075055d7b702375223349ff9efd8de71bd2a0181d9c26ff42034b4c
SSDEEP

3072:VfYQg/wMEmUQctaceqDtc3/f1ykUMQYU1N:ZYD/wH9a/sqf1BUMy

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2964	2904	rundll32.exe	28
PID 2904 wrote to memory of 2964	2904	rundll32.exe	28
PID 2904 wrote to memory of 2964	2904	rundll32.exe	28
PID 2904 wrote to memory of 2964	2904	rundll32.exe	28
PID 2904 wrote to memory of 2964	2904	rundll32.exe	28
PID 2904 wrote to memory of 2964	2904	rundll32.exe	28
PID 2904 wrote to memory of 2964	2904	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe7874ad0ef50befc50a92401f381ee8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe7874ad0ef50befc50a92401f381ee8_JaffaCakes118.dll,#1
  2⤵
  PID:2964