06408b776e4fd2e22fea7078009f8ddc636edfde55db090b95ab6113524dc4bd

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 20:55

Target

147251db3cf8e3392faae63fae79de6e_JaffaCakes118.dll
Size

840KB
MD5

147251db3cf8e3392faae63fae79de6e
SHA1

af0a7e6f81cfdcabad4d1ee0e62fed67a2ab6719
SHA256

06408b776e4fd2e22fea7078009f8ddc636edfde55db090b95ab6113524dc4bd
SHA512

65a4075ad6e164aa7b39753ec6df9338bb8871b28e0ce90859d9c3752b2a30988a6e1b246965818b59e2b58a6653801d41bdee054c470c81fad1ba4e364461d3
SSDEEP

12288:GWxr/sS2I8vsnqe9VmqMikImdCKKNhc3TCPZqBuEPa7UWh5tSLVtRs0Cy+:GWpAI8vGv/FMik1Cfzc3wZqwAWJwCJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1728	2032	rundll32.exe	28
PID 2032 wrote to memory of 1728	2032	rundll32.exe	28
PID 2032 wrote to memory of 1728	2032	rundll32.exe	28
PID 2032 wrote to memory of 1728	2032	rundll32.exe	28
PID 2032 wrote to memory of 1728	2032	rundll32.exe	28
PID 2032 wrote to memory of 1728	2032	rundll32.exe	28
PID 2032 wrote to memory of 1728	2032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\147251db3cf8e3392faae63fae79de6e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\147251db3cf8e3392faae63fae79de6e_JaffaCakes118.dll,#1
  2⤵
  PID:1728