80bb1311a92dd650daab99f3782d318ff3b87d3401b99b4b0443efb0eff81864

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 06:16

Target

624e5eca6fef9f16df3e9740e960425d_JaffaCakes118.dll
Size

66KB
MD5

624e5eca6fef9f16df3e9740e960425d
SHA1

3b4ff5d5ddfeb70df08014c3c105ed94b4ba28d6
SHA256

80bb1311a92dd650daab99f3782d318ff3b87d3401b99b4b0443efb0eff81864
SHA512

c5c49edaf1b1d1eddb20fd8e7c40de4c929486c0733b073441064b123be146ff2b3ed7d84d9706d92804cafd4a46b55f482dc0d8606aa3010db25e7525bf5642
SSDEEP

1536:BGb2oMXzKANKZTMg2lU9zwcN8xtksiigA2GvIUpn:BGKuANKe7lU9zwINxGvIw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1684	2012	rundll32.exe	28
PID 2012 wrote to memory of 1684	2012	rundll32.exe	28
PID 2012 wrote to memory of 1684	2012	rundll32.exe	28
PID 2012 wrote to memory of 1684	2012	rundll32.exe	28
PID 2012 wrote to memory of 1684	2012	rundll32.exe	28
PID 2012 wrote to memory of 1684	2012	rundll32.exe	28
PID 2012 wrote to memory of 1684	2012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\624e5eca6fef9f16df3e9740e960425d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\624e5eca6fef9f16df3e9740e960425d_JaffaCakes118.dll,#1
  2⤵
  PID:1684