ec53014e4c07088fd84a20e0944250cd5a84f558c7a129d6ff73ae908431ce74

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 15:19

Target

ff938474cb2c9e3727d1a2ae4281ef12_JaffaCakes118.dll
Size

8KB
MD5

ff938474cb2c9e3727d1a2ae4281ef12
SHA1

407b7a915ce75453f9234979c4d91aacd1b5fa92
SHA256

ec53014e4c07088fd84a20e0944250cd5a84f558c7a129d6ff73ae908431ce74
SHA512

0ed6ae09d428ba5f5dc7de7fc36ea18ea5166b1ebc547ab49ac2e1a6bf9c9defbc73a0d295bd8f830a4f556fac02be2e230d51d08b6c82885189198798d491d3
SSDEEP

192:ilGqrwY9XK9KeNJoHjCNQcdFW6CAVMDtfdwFuTHVGL:ilJ94JoDkJW6C3Nd+uTVGL

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1612	2000	rundll32.exe	28
PID 2000 wrote to memory of 1612	2000	rundll32.exe	28
PID 2000 wrote to memory of 1612	2000	rundll32.exe	28
PID 2000 wrote to memory of 1612	2000	rundll32.exe	28
PID 2000 wrote to memory of 1612	2000	rundll32.exe	28
PID 2000 wrote to memory of 1612	2000	rundll32.exe	28
PID 2000 wrote to memory of 1612	2000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff938474cb2c9e3727d1a2ae4281ef12_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff938474cb2c9e3727d1a2ae4281ef12_JaffaCakes118.dll,#1
  2⤵
  PID:1612