04a75b67321c6dbfe75ce1ff08220446ae4c3ff06adb65f2f5cf5d3124403ae1

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 02:12

Target

27cbf3b0244a31aad25df685859f8023_JaffaCakes118.dll
Size

1.0MB
MD5

27cbf3b0244a31aad25df685859f8023
SHA1

2b812b2d68f612de69c135aa940ccdafaad32115
SHA256

04a75b67321c6dbfe75ce1ff08220446ae4c3ff06adb65f2f5cf5d3124403ae1
SHA512

b1f6fcf8f9979eed0cccd09b59a3cb70aeb3f147ea8aabe38a57c97cd447eeb100598b9d8d5f301e29f0216244880bb454a655202196c3197e26947a77504df3
SSDEEP

24576:alsTXlc5VKbeu+pS0+M3tb0pvaep5ZV1yji:ZT2u/0J3tCieDki

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 2032	1392	rundll32.exe	28
PID 1392 wrote to memory of 2032	1392	rundll32.exe	28
PID 1392 wrote to memory of 2032	1392	rundll32.exe	28
PID 1392 wrote to memory of 2032	1392	rundll32.exe	28
PID 1392 wrote to memory of 2032	1392	rundll32.exe	28
PID 1392 wrote to memory of 2032	1392	rundll32.exe	28
PID 1392 wrote to memory of 2032	1392	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27cbf3b0244a31aad25df685859f8023_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27cbf3b0244a31aad25df685859f8023_JaffaCakes118.dll,#1
  2⤵
  PID:2032