9d66a23b87e930269204272a71063d5e616a7b40cd6e9e08775c26c23a135a2b

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 17:23

Target

604bbf50778c5ddc4a8ff974d12c9296_JaffaCakes118.dll
Size

254KB
MD5

604bbf50778c5ddc4a8ff974d12c9296
SHA1

e8043e4a32fc3a3da97db2c98a004880f574030b
SHA256

9d66a23b87e930269204272a71063d5e616a7b40cd6e9e08775c26c23a135a2b
SHA512

f71d456020063b1dbf8e06bad519f287ec9aa569c2aa2a2318615994fe346b3edbce8117e72b473fbb4c7f010814dd03902cedce7aabf3ff447d980747e22a62
SSDEEP

3072:2SfGIqV98OeZybMPgHN5rHy0mmaK2lJ1xJuY+2vOTW0L8zNO3I52Qm:2SHqV98QbIvnlJ1NKW0LYsom

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2008	3068	rundll32.exe	28
PID 3068 wrote to memory of 2008	3068	rundll32.exe	28
PID 3068 wrote to memory of 2008	3068	rundll32.exe	28
PID 3068 wrote to memory of 2008	3068	rundll32.exe	28
PID 3068 wrote to memory of 2008	3068	rundll32.exe	28
PID 3068 wrote to memory of 2008	3068	rundll32.exe	28
PID 3068 wrote to memory of 2008	3068	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\604bbf50778c5ddc4a8ff974d12c9296_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\604bbf50778c5ddc4a8ff974d12c9296_JaffaCakes118.dll,#1
  2⤵
  PID:2008