2320a95900a6db6f92d1b85ab8c431ef362652791f74e5a91af9f8ce4a4c5f60

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 06:11

Target

6644d9dae05298b7cc943613aac91a91_JaffaCakes118.dll
Size

175KB
MD5

6644d9dae05298b7cc943613aac91a91
SHA1

6317e5d49e508ea03857063afcf10d50b16d34a7
SHA256

2320a95900a6db6f92d1b85ab8c431ef362652791f74e5a91af9f8ce4a4c5f60
SHA512

726c251c818bc57ecad956acd13f9bc27178c0ef201fd1ed3aafb389788448e01b79c3e050db7effe3ed667707868374ea5b6ee60f418cb5f059d8a4d56fffe8
SSDEEP

3072:vcDZMXJSDYzmcMN7Q4+WV+vZcJsMdWz3EYhdYC:vPSDYz+Q42NvkC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6644d9dae05298b7cc943613aac91a91_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6644d9dae05298b7cc943613aac91a91_JaffaCakes118.dll,#1
  2⤵
  PID:2496