acd227350dea6b1d35852d467f7e5de53bab38f53e15c61151f897d6c6bdc6c9

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 05:05

Target

0b1dab2feb114786f573a915c70eeaf5_JaffaCakes118.dll
Size

80KB
MD5

0b1dab2feb114786f573a915c70eeaf5
SHA1

3bba9ca3944a5c37ef1f97b8faee430aefebf55d
SHA256

acd227350dea6b1d35852d467f7e5de53bab38f53e15c61151f897d6c6bdc6c9
SHA512

d1f93208a3af6b169c4164a577c3a6864ccb7349d02fd9a8cfbbd7d627058920f20cfe8ba6ed6347cf64722f0d11beeae09ccf562da53308d5c9c4b8c98277e7
SSDEEP

1536:WrRQtfuQCsB9wSuiRvxjIWca6a4E18aNEmUrFR5KEpREzV+wmieRi5W8EBaRzE:ykm+GdiRZjIM6aL8axIxKETK+wKiEaNE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2036	2420	rundll32.exe	28
PID 2420 wrote to memory of 2036	2420	rundll32.exe	28
PID 2420 wrote to memory of 2036	2420	rundll32.exe	28
PID 2420 wrote to memory of 2036	2420	rundll32.exe	28
PID 2420 wrote to memory of 2036	2420	rundll32.exe	28
PID 2420 wrote to memory of 2036	2420	rundll32.exe	28
PID 2420 wrote to memory of 2036	2420	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b1dab2feb114786f573a915c70eeaf5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b1dab2feb114786f573a915c70eeaf5_JaffaCakes118.dll,#1
  2⤵
  PID:2036