a7acace7c211690a48e2e1ba5207520189b65913b3eadb4e300f3a124b733984

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 05:09

Target

90a1ef650b3ce5d08f4773d3d995ee18_JaffaCakes118.dll
Size

193KB
MD5

90a1ef650b3ce5d08f4773d3d995ee18
SHA1

0df75b4e029c063221988a420330515e5dbf0a7f
SHA256

a7acace7c211690a48e2e1ba5207520189b65913b3eadb4e300f3a124b733984
SHA512

15ea79de045ab08517c768920bd10cae5cd95ff93233e67cf0a19067177ca8132842a2cf6787189c444fd1447070f392131a29ebd1648d010ba4b6cf706000fe
SSDEEP

3072:/C+uxfp04D0djfdi3z3D2UuzSwyKbppTIEOOlMAChaST7ib/4NFg:/ixR0a6dqLAzMmTBC/Gv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2380	2164	rundll32.exe	28
PID 2164 wrote to memory of 2380	2164	rundll32.exe	28
PID 2164 wrote to memory of 2380	2164	rundll32.exe	28
PID 2164 wrote to memory of 2380	2164	rundll32.exe	28
PID 2164 wrote to memory of 2380	2164	rundll32.exe	28
PID 2164 wrote to memory of 2380	2164	rundll32.exe	28
PID 2164 wrote to memory of 2380	2164	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90a1ef650b3ce5d08f4773d3d995ee18_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\90a1ef650b3ce5d08f4773d3d995ee18_JaffaCakes118.dll,#1
  2⤵
  PID:2380