90473d93e4d1f2943d04c5f237fc219fd95fe0cda51251eb6aaf3d8b305eba11

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 16:01

Target

6b7a588048aba96888a969240359df18_JaffaCakes118.dll
Size

1022KB
MD5

6b7a588048aba96888a969240359df18
SHA1

0ade4fe7fe38ffce904294e0b60751428728840a
SHA256

90473d93e4d1f2943d04c5f237fc219fd95fe0cda51251eb6aaf3d8b305eba11
SHA512

4c70c419ec7193aa9a90022d78b0e2d8bdd9686cdcfcef4e6087c43be468d16dbc50e35114cb166e4a474ceb6b4f90a9d1ed59df75dd411c1ddca8d5c0f92df8
SSDEEP

24576:N5TV8hlW80MafypSNBWzd/U2sg5XOjUUWRJgJR9b:bmhlnSOzNJWjUrRCJz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2272	2816	rundll32.exe	28
PID 2816 wrote to memory of 2272	2816	rundll32.exe	28
PID 2816 wrote to memory of 2272	2816	rundll32.exe	28
PID 2816 wrote to memory of 2272	2816	rundll32.exe	28
PID 2816 wrote to memory of 2272	2816	rundll32.exe	28
PID 2816 wrote to memory of 2272	2816	rundll32.exe	28
PID 2816 wrote to memory of 2272	2816	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b7a588048aba96888a969240359df18_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b7a588048aba96888a969240359df18_JaffaCakes118.dll,#1
  2⤵
  PID:2272