6947fc58fc0713b3741be9306995b97359f65976de00682dc563e8083ea98fbb

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 05:19

Target

69db2deedc01f06b76dd8a5646e53de3_JaffaCakes118.dll
Size

136KB
MD5

69db2deedc01f06b76dd8a5646e53de3
SHA1

65b989c76354283e15bf718863d5f35ef2a3ee4d
SHA256

6947fc58fc0713b3741be9306995b97359f65976de00682dc563e8083ea98fbb
SHA512

a231b0d95c5f5b6421a44f5ad432bd3773ab424066e8729ef2fa3068d528a918c6c2c7b524e1ed9b5ed90c63cc212292f912e0b3d16076223624948da6e6e87f
SSDEEP

1536:4E9glIhEXAwCTAJpWRKq6Y2uE577IhknnNBnmO1Yyt+Sob3kfXBIaov98STFON3O:t+eAE6YgBDnGytVobOXBBYxEBQ3GO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1964	1684	rundll32.exe	28
PID 1684 wrote to memory of 1964	1684	rundll32.exe	28
PID 1684 wrote to memory of 1964	1684	rundll32.exe	28
PID 1684 wrote to memory of 1964	1684	rundll32.exe	28
PID 1684 wrote to memory of 1964	1684	rundll32.exe	28
PID 1684 wrote to memory of 1964	1684	rundll32.exe	28
PID 1684 wrote to memory of 1964	1684	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\69db2deedc01f06b76dd8a5646e53de3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\69db2deedc01f06b76dd8a5646e53de3_JaffaCakes118.dll,#1
  2⤵
  PID:1964