82dd63244cb10efa47d448ae499b6626c3d1b15e26db19d141ed65d5ac3fd490

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 19:01

Target

7e0a0b8711c1a1570b6a18d85d308d76_JaffaCakes118.dll
Size

48KB
MD5

7e0a0b8711c1a1570b6a18d85d308d76
SHA1

54b8e3c06fdd4a249c7d4cc5706e369956f40da1
SHA256

82dd63244cb10efa47d448ae499b6626c3d1b15e26db19d141ed65d5ac3fd490
SHA512

66c955a41d9497bcf4be328a01606a6ce698615080f82313ebae9f708aafee32f4e1da79ba5dace0b493a78c7a9232a55b16ec91858ed32047d3152401c341fa
SSDEEP

384:KjLpW6Io+Lvn+ogGPP7PREZWzRHdOit+qvS9WjIaNEkpy1YaoZu:KjLEnzvn+BGPTVvO1qvS9Wj3NYGaow

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2856	1808	rundll32.exe	28
PID 1808 wrote to memory of 2856	1808	rundll32.exe	28
PID 1808 wrote to memory of 2856	1808	rundll32.exe	28
PID 1808 wrote to memory of 2856	1808	rundll32.exe	28
PID 1808 wrote to memory of 2856	1808	rundll32.exe	28
PID 1808 wrote to memory of 2856	1808	rundll32.exe	28
PID 1808 wrote to memory of 2856	1808	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7e0a0b8711c1a1570b6a18d85d308d76_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7e0a0b8711c1a1570b6a18d85d308d76_JaffaCakes118.dll,#1
  2⤵
  PID:2856