9d10f3830527638dc6518cdc2a5adc2d91aea512d507939678b04c312078b25c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 11:11

Target

2067f3df259b6aac08bf1e755b265edd_JaffaCakes118.dll
Size

1.0MB
MD5

2067f3df259b6aac08bf1e755b265edd
SHA1

980a051823ac621f41b68db42aaa98ea4c1dd108
SHA256

9d10f3830527638dc6518cdc2a5adc2d91aea512d507939678b04c312078b25c
SHA512

acb1a497c0efc0cd5a99a6784b10d1b306bb4d30cd5cb1661529d1d76e236e2590962a7e0df917967b9d7194b8f353554e1a150c5d0411059ba37ba86e3880f8
SSDEEP

24576:QxCjV8F383ji1dSUxhXTXPbFbGPEOsQUVRkUIpg:cn3Oji1xXTlcsQUVRKpg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2924 wrote to memory of 1952	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 1952	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 1952	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 1952	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 1952	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 1952	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 1952	2924	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2067f3df259b6aac08bf1e755b265edd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2067f3df259b6aac08bf1e755b265edd_JaffaCakes118.dll,#1
2⤵
PID:1952