71297955ad65a075b8f7468c3bccb080ff60e8790a07edc5173cb28ce93f6486

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 22:20

Target

8518a535cb26e310321a2ddb6cea8980_JaffaCakes118.dll
Size

63KB
MD5

8518a535cb26e310321a2ddb6cea8980
SHA1

51b35c9fd80e669b7ebdeb1e29f18cabe7cd0d23
SHA256

71297955ad65a075b8f7468c3bccb080ff60e8790a07edc5173cb28ce93f6486
SHA512

63e1b403f82bac99cd3179f0c2235c1afe72397a2aaa33a87bc516c0050ae962e5f6d46259d68d57ac54a47c1123014ee1b6a28fee202cba7d39cd2bb43ecbe4
SSDEEP

1536:YFT2IyJsYzookcRiJW88z0h2ZG6y50MTfdtpfpu:YFvokJJNhH6y5jB/s

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2320	2208	rundll32.exe	29
PID 2208 wrote to memory of 2320	2208	rundll32.exe	29
PID 2208 wrote to memory of 2320	2208	rundll32.exe	29
PID 2208 wrote to memory of 2320	2208	rundll32.exe	29
PID 2208 wrote to memory of 2320	2208	rundll32.exe	29
PID 2208 wrote to memory of 2320	2208	rundll32.exe	29
PID 2208 wrote to memory of 2320	2208	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8518a535cb26e310321a2ddb6cea8980_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8518a535cb26e310321a2ddb6cea8980_JaffaCakes118.dll,#1
  2⤵
  PID:2320