064348bd532e724431da24593a55af29b52bebb027744668296560be0b293342

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 07:35

Target

0de57e404ac0e9c7431377a55130748e_JaffaCakes118.dll
Size

58KB
MD5

0de57e404ac0e9c7431377a55130748e
SHA1

7c34d0b27ad5c175a2fc22fa0c18f320a601c190
SHA256

064348bd532e724431da24593a55af29b52bebb027744668296560be0b293342
SHA512

31edf6d956ae515f4af0998dcb5dcb8a047dcc7cfc062ad5918170cabd560ef68e3f20bb68bb60f92afd28a2f8488cc84b9c56856d4d4b64ec18931825d340ec
SSDEEP

1536:HLbWEo25hu8mgpJ5DWmGK81Vc+4G9cpDpo6q5cyL:HHFo2jIgpJHGK8vcNGupDvyL

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2740	3028	rundll32.exe	28
PID 3028 wrote to memory of 2740	3028	rundll32.exe	28
PID 3028 wrote to memory of 2740	3028	rundll32.exe	28
PID 3028 wrote to memory of 2740	3028	rundll32.exe	28
PID 3028 wrote to memory of 2740	3028	rundll32.exe	28
PID 3028 wrote to memory of 2740	3028	rundll32.exe	28
PID 3028 wrote to memory of 2740	3028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0de57e404ac0e9c7431377a55130748e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0de57e404ac0e9c7431377a55130748e_JaffaCakes118.dll,#1
  2⤵
  PID:2740