1643f4225622c610814de332b42270926f4776dc864d9349923917f4e92ac8cb

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 22:45

Target

14d0429a230198f77bd856966aaddae3_JaffaCakes118.dll
Size

192KB
MD5

14d0429a230198f77bd856966aaddae3
SHA1

b88862f1a306cea0c6f8211dd1b267d6e4432183
SHA256

1643f4225622c610814de332b42270926f4776dc864d9349923917f4e92ac8cb
SHA512

021e0770496092075ab25604f4950d9678a655fd1e121841341b0aa5da5c5f5ae6efceddc0a4ddb9bd0b1ceda1ad646195d690a9d4d64b43ef2b00f8c7fcf189
SSDEEP

3072:3NbpOnPsGqQTruHLD7RcQxKrrdNU0VAtrOpOOWxOv4Kn7qbjx7T/Hrm38:3NbqaLD7RcukVAtSQOWcgWqbV77Lm38

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2168	2248	rundll32.exe	28
PID 2248 wrote to memory of 2168	2248	rundll32.exe	28
PID 2248 wrote to memory of 2168	2248	rundll32.exe	28
PID 2248 wrote to memory of 2168	2248	rundll32.exe	28
PID 2248 wrote to memory of 2168	2248	rundll32.exe	28
PID 2248 wrote to memory of 2168	2248	rundll32.exe	28
PID 2248 wrote to memory of 2168	2248	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14d0429a230198f77bd856966aaddae3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14d0429a230198f77bd856966aaddae3_JaffaCakes118.dll,#1
  2⤵
  PID:2168