10b7655d26c3a7fc23ea6179c7853f1ce073511a9785a3dc54670daff521291d

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 12:16

Target

179f8339027039863bb21cbf05cb03f2_JaffaCakes118.dll
Size

1.1MB
MD5

179f8339027039863bb21cbf05cb03f2
SHA1

183e32a22c21743b0b4dde9d186450a53cacc2d0
SHA256

10b7655d26c3a7fc23ea6179c7853f1ce073511a9785a3dc54670daff521291d
SHA512

0141796b8f06ba7a8ecfaaac63b6d7c2a567e50d0ee99ac7f8a242093b31c74e17c9150efe800ed2ab015dbb23ab8fed8b5b08331829788dbbeb4bd275b3d33c
SSDEEP

24576:x5ZIU3ZZYvxM5n0gF97oIlYIJxrzkpakUwguJjf6:FIMegfF9ze65zkAkUI6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2020 wrote to memory of 2320	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 2320	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 2320	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 2320	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 2320	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 2320	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 2320	2020	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\179f8339027039863bb21cbf05cb03f2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\179f8339027039863bb21cbf05cb03f2_JaffaCakes118.dll,#1
2⤵
PID:2320