215cc07206823fc9b515461eade364ccc5d95123f3f9f9919952c97d16ce8576

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 00:06

Target

4dadfd9d6065e9c17bec2e45115cfb52_JaffaCakes118.dll
Size

1.0MB
MD5

4dadfd9d6065e9c17bec2e45115cfb52
SHA1

72d748c23ea67194f0597b937634fbaea693a1b1
SHA256

215cc07206823fc9b515461eade364ccc5d95123f3f9f9919952c97d16ce8576
SHA512

34d018915c742337d8ece09b31f6e4c822ff89e71124db11df83f1b2d8f938ba5f6182bb9ff486a4e9c321703c7f3922a4527b559c89b46fbad934f5197061cb
SSDEEP

24576:7cPX1YZDE7OtO8JeWgZvb858vJh2NStp6Kk:AqDE7OYWglcMKiFk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2004 wrote to memory of 2056	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2056	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2056	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2056	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2056	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2056	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2056	2004	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dadfd9d6065e9c17bec2e45115cfb52_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dadfd9d6065e9c17bec2e45115cfb52_JaffaCakes118.dll,#1
2⤵
PID:2056