08280676faf46942c37b44b0837211e81570b061155c5ce97324c5414eda307b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 13:22

Target

6ea6fd0147928e5582949e6ba87301bb_JaffaCakes118.dll
Size

59KB
MD5

6ea6fd0147928e5582949e6ba87301bb
SHA1

e2aad00639ca0e314a32ffc5816d81215adeb189
SHA256

08280676faf46942c37b44b0837211e81570b061155c5ce97324c5414eda307b
SHA512

2d615d90b4825ac63e69b27e764a4704fe33322babdde1372be0664b87b41181090fda871692575bc8683d60b159f08a2af3dd423249ad195c0a0460d965e1d7
SSDEEP

768:2pavb/YTMD9XVZzzWpe/GAlAISSwMJfUfI4/jVSm1qUhrUTcWhICwg4NcJkpRBem:2AVJ0mhfwMJfUweJp94cWLdftg0J4F

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2468	2264	rundll32.exe	28
PID 2264 wrote to memory of 2468	2264	rundll32.exe	28
PID 2264 wrote to memory of 2468	2264	rundll32.exe	28
PID 2264 wrote to memory of 2468	2264	rundll32.exe	28
PID 2264 wrote to memory of 2468	2264	rundll32.exe	28
PID 2264 wrote to memory of 2468	2264	rundll32.exe	28
PID 2264 wrote to memory of 2468	2264	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ea6fd0147928e5582949e6ba87301bb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ea6fd0147928e5582949e6ba87301bb_JaffaCakes118.dll,#1
  2⤵
  PID:2468