220a95ecd7e2ff8f9f72b7af73e6202e0a55bfbd993447bcd0251fe8330b5678

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 14:35

Target

6797cbcdac8b713e6e8f0be6a0911d9b_JaffaCakes118.dll
Size

523KB
MD5

6797cbcdac8b713e6e8f0be6a0911d9b
SHA1

faadbef091baa455d55fcd84252536a96af1301c
SHA256

220a95ecd7e2ff8f9f72b7af73e6202e0a55bfbd993447bcd0251fe8330b5678
SHA512

47a450af6d037d4ec7ed813124ec18479550544bddc342a21bdd1a642a77848a426bfc84b5e7d9005f311cac2c7154683e8296e51d4380587b1484820c4a0bcf
SSDEEP

12288:UypFlu2BpLiPwlUfIKKuioD4LP22dwfItb9BY:UypFllsQUfIKKuZAP2i6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2304	2328	rundll32.exe	28
PID 2328 wrote to memory of 2304	2328	rundll32.exe	28
PID 2328 wrote to memory of 2304	2328	rundll32.exe	28
PID 2328 wrote to memory of 2304	2328	rundll32.exe	28
PID 2328 wrote to memory of 2304	2328	rundll32.exe	28
PID 2328 wrote to memory of 2304	2328	rundll32.exe	28
PID 2328 wrote to memory of 2304	2328	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6797cbcdac8b713e6e8f0be6a0911d9b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6797cbcdac8b713e6e8f0be6a0911d9b_JaffaCakes118.dll,#1
  2⤵
  PID:2304