13191716f198773820070783fe9fa5dfb923b2c37b39af5b8f8baf86bd4e37c1

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 23:25

Target

8c269999768870233e51bd764e211578_JaffaCakes118.dll
Size

23KB
MD5

8c269999768870233e51bd764e211578
SHA1

89d3d91b63ccb3fda5be51c28a6df1cada804cd2
SHA256

13191716f198773820070783fe9fa5dfb923b2c37b39af5b8f8baf86bd4e37c1
SHA512

723b2076168c793e378b204e0e5ce2502af4782ec485a4c11fb750dbafff1c09029147531b6a8800bbba68e6aefecfa6d92d217ccdc02e5c411f606be04bc923
SSDEEP

384:LF40YeqVxDXdPV7ILPZKdtBly4RnLr3PL/Iv:FNqVhdPVGZKdtjy4R/Le

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c269999768870233e51bd764e211578_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c269999768870233e51bd764e211578_JaffaCakes118.dll,#1
  2⤵
  PID:2012