e76fb911d43941852d91d028941f6ac8914a227e6c84e43af09b4d1c25dbb0d8

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 04:55

Target

fe7ae18af53c793a8d656bb97dd02dd2_JaffaCakes118.dll
Size

60KB
MD5

fe7ae18af53c793a8d656bb97dd02dd2
SHA1

9d910aeeac09ef3839833405df514298c86184fa
SHA256

e76fb911d43941852d91d028941f6ac8914a227e6c84e43af09b4d1c25dbb0d8
SHA512

047775f2f0d948bf46e65d186b3db444a53f4af67e4f9477eefbc6a057d92c405405073a92eb879869c24793aceef76fccd2193f46426489be7f4984e64d3f2b
SSDEEP

1536:385zqrYWYVw53Cr8PZPOsLFFbHNxaV8o6aSkuP:3izqrNGGq8PksLbbHN48onu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1732	1848	rundll32.exe	28
PID 1848 wrote to memory of 1732	1848	rundll32.exe	28
PID 1848 wrote to memory of 1732	1848	rundll32.exe	28
PID 1848 wrote to memory of 1732	1848	rundll32.exe	28
PID 1848 wrote to memory of 1732	1848	rundll32.exe	28
PID 1848 wrote to memory of 1732	1848	rundll32.exe	28
PID 1848 wrote to memory of 1732	1848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe7ae18af53c793a8d656bb97dd02dd2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe7ae18af53c793a8d656bb97dd02dd2_JaffaCakes118.dll,#1
  2⤵
  PID:1732