0dc9b810ce9fc9cd1e06899a0fbf168f6d39356acda14128a943ac17901576f0

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 08:33

Target

74e528ee0b6d1c046285f7fec3576969_JaffaCakes118.dll
Size

4.0MB
MD5

74e528ee0b6d1c046285f7fec3576969
SHA1

52c12abdc468697e72e5bd8bf6e1160ae4e99181
SHA256

0dc9b810ce9fc9cd1e06899a0fbf168f6d39356acda14128a943ac17901576f0
SHA512

f53a6ff0f2ed0def19e6975cd883ff14413335c7e49af85334c080dec0591c90f5921f3d84bb0d346ecd7e54a75f2f7a1502d7e75e83789bc14122c27d28c70f
SSDEEP

98304:B+1JVMtzfjHiZPmGW6K76AXUDA8VA6BLKoB:B+VkXHilXWT7vXF6ooB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2300	2172	rundll32.exe	28
PID 2172 wrote to memory of 2300	2172	rundll32.exe	28
PID 2172 wrote to memory of 2300	2172	rundll32.exe	28
PID 2172 wrote to memory of 2300	2172	rundll32.exe	28
PID 2172 wrote to memory of 2300	2172	rundll32.exe	28
PID 2172 wrote to memory of 2300	2172	rundll32.exe	28
PID 2172 wrote to memory of 2300	2172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74e528ee0b6d1c046285f7fec3576969_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\74e528ee0b6d1c046285f7fec3576969_JaffaCakes118.dll,#1
  2⤵
  PID:2300