23611a350681a294e4686b21b7f87c27fd966315c9dbd5bf62d3805649be014a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 12:21

Target

12b71a22c653e6f8373fbe7dc0458450_JaffaCakes118.dll
Size

1.1MB
MD5

12b71a22c653e6f8373fbe7dc0458450
SHA1

9badafb2922199bd0e9b8da9c17270e5d62b83bb
SHA256

23611a350681a294e4686b21b7f87c27fd966315c9dbd5bf62d3805649be014a
SHA512

78976374022a65df671dc75d9a1d479e9b70dc561fd6fe297b22fc494e64cbef8f93ba9b1f4ffc3ce158b2d6aac58b2445f7b5c1735e2f12f69112b1699e855a
SSDEEP

24576:5/QAzDSZGEt+VI4TWuncDqbGHAqbRjsX4ofOhQiHnoo9sQXUZ:uAX+G2+ui16IGHrbRYX7OTT96

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 1880	1040	rundll32.exe	28
PID 1040 wrote to memory of 1880	1040	rundll32.exe	28
PID 1040 wrote to memory of 1880	1040	rundll32.exe	28
PID 1040 wrote to memory of 1880	1040	rundll32.exe	28
PID 1040 wrote to memory of 1880	1040	rundll32.exe	28
PID 1040 wrote to memory of 1880	1040	rundll32.exe	28
PID 1040 wrote to memory of 1880	1040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12b71a22c653e6f8373fbe7dc0458450_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12b71a22c653e6f8373fbe7dc0458450_JaffaCakes118.dll,#1
  2⤵
  PID:1880