167d60b8f855c23f83bcb33c322b2243412ce0e0a63749b2fb99c3c7f4b24083

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 21:50

Target

68c0d787d78125e3b40388324da9908d_JaffaCakes118.dll
Size

192KB
MD5

68c0d787d78125e3b40388324da9908d
SHA1

19f3a1a50dd8d90657e4e7c86e169bbbd2c26eea
SHA256

167d60b8f855c23f83bcb33c322b2243412ce0e0a63749b2fb99c3c7f4b24083
SHA512

4d49f2d5ee4c3cdf0cbb6a1841fb81e005f081f6cc9c5583dc38638c86bbb02ebfaf985863d39f4bfe925e4b88accacd209c3f9bea9124e9756dcfe0f2c53464
SSDEEP

3072:cNbpOnPsGqQTruHLD7RcQxKrrdNU0VAtrOpOOWxOv4Kn7qbjx7T/HrmV:cNbqaLD7RcukVAtSQOWcgWqbV77LmV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2796 wrote to memory of 1804	2796	rundll32.exe	rundll32.exe
PID 2796 wrote to memory of 1804	2796	rundll32.exe	rundll32.exe
PID 2796 wrote to memory of 1804	2796	rundll32.exe	rundll32.exe
PID 2796 wrote to memory of 1804	2796	rundll32.exe	rundll32.exe
PID 2796 wrote to memory of 1804	2796	rundll32.exe	rundll32.exe
PID 2796 wrote to memory of 1804	2796	rundll32.exe	rundll32.exe
PID 2796 wrote to memory of 1804	2796	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68c0d787d78125e3b40388324da9908d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2796

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68c0d787d78125e3b40388324da9908d_JaffaCakes118.dll,#1
2⤵
PID:1804