137edda805267f31cf25ffb8a109ebf2828faece221bd9ebbdee470cbbab695c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 11:17

Target

3f38b208739c4c7de86a2f2ecc80c07a_JaffaCakes118.dll
Size

174KB
MD5

3f38b208739c4c7de86a2f2ecc80c07a
SHA1

6bb9a27dc4f4301eb275650ce1911fb3b3ab2a4f
SHA256

137edda805267f31cf25ffb8a109ebf2828faece221bd9ebbdee470cbbab695c
SHA512

f42153fa5b26c715979311b08b4660c80397776328bec3ec577eaf7191ae9f3f14ceee37a01b3b70145dd5eb962255cee207cebf24cc0af419c11e214802c71b
SSDEEP

3072:Ii7jZ5uH6Y7hGJRWhF+q00IR1kV1/hRYMWSClgFdfvYN:peD7hGJgaM/XPpFdoN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2072	2164	rundll32.exe	28
PID 2164 wrote to memory of 2072	2164	rundll32.exe	28
PID 2164 wrote to memory of 2072	2164	rundll32.exe	28
PID 2164 wrote to memory of 2072	2164	rundll32.exe	28
PID 2164 wrote to memory of 2072	2164	rundll32.exe	28
PID 2164 wrote to memory of 2072	2164	rundll32.exe	28
PID 2164 wrote to memory of 2072	2164	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f38b208739c4c7de86a2f2ecc80c07a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f38b208739c4c7de86a2f2ecc80c07a_JaffaCakes118.dll,#1
  2⤵
  PID:2072