8cff7e78215503ca0f820a607c00a646407690cfcda0c1d3d4d88eaf9adbbe67

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 15:19

Target

798b3307a7c129707e8a5748db047aa3_JaffaCakes118.dll
Size

856KB
MD5

798b3307a7c129707e8a5748db047aa3
SHA1

8303ccd3f6ff68d3a20032d49144df9d84cfddcd
SHA256

8cff7e78215503ca0f820a607c00a646407690cfcda0c1d3d4d88eaf9adbbe67
SHA512

a2e164d4f4343287a0806252eb4d8e641d2b0ee96234efb7d916e22b23c5da15ff7a4723822a2e1e7db7882c9ddf0ffb04013f16bf6feace9b01ea92240c1879
SSDEEP

12288:y/SGVpwKP9qK7pCBBPwXb2rRQHrpIVu9n2xPT/FVFZ:yqGT9P9R654bsrVu9n2xPT/5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2000	2912	rundll32.exe	28
PID 2912 wrote to memory of 2000	2912	rundll32.exe	28
PID 2912 wrote to memory of 2000	2912	rundll32.exe	28
PID 2912 wrote to memory of 2000	2912	rundll32.exe	28
PID 2912 wrote to memory of 2000	2912	rundll32.exe	28
PID 2912 wrote to memory of 2000	2912	rundll32.exe	28
PID 2912 wrote to memory of 2000	2912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\798b3307a7c129707e8a5748db047aa3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\798b3307a7c129707e8a5748db047aa3_JaffaCakes118.dll,#1
  2⤵
  PID:2000