88133cb104e1f6698e1774ad1948568eeef0a967abedb68d1b3a65defe813b62

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 19:14

Target

05e341259e5f4f5ea88cfb7fb21ede60_JaffaCakes118.dll
Size

75KB
MD5

05e341259e5f4f5ea88cfb7fb21ede60
SHA1

b98bf699d6319cf7fa060c745fb4c472069e8f75
SHA256

88133cb104e1f6698e1774ad1948568eeef0a967abedb68d1b3a65defe813b62
SHA512

8a16b1dbf0f0ef24168c6af125941625f6e2de6987364d732aaafcebc022b8b7eebd893727d2d543c9657d2c229b07d04c3b4d68a3d2fa3333e8dc17495fbd8a
SSDEEP

1536:TOd7zNJCY0jX0wt0N2c0TWvBTqORjn+buw3:Sd1JQt+F0qvZ/n+bX3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2044	2180	rundll32.exe	28
PID 2180 wrote to memory of 2044	2180	rundll32.exe	28
PID 2180 wrote to memory of 2044	2180	rundll32.exe	28
PID 2180 wrote to memory of 2044	2180	rundll32.exe	28
PID 2180 wrote to memory of 2044	2180	rundll32.exe	28
PID 2180 wrote to memory of 2044	2180	rundll32.exe	28
PID 2180 wrote to memory of 2044	2180	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05e341259e5f4f5ea88cfb7fb21ede60_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05e341259e5f4f5ea88cfb7fb21ede60_JaffaCakes118.dll,#1
  2⤵
  PID:2044