2e684c176fd28742fa4afd4092f7cc25fc5f3d8a9589f52c632dbb25903dc868

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 21:38

Target

96591260864ceb91f402d274b7ba8f29_JaffaCakes118.dll
Size

396KB
MD5

96591260864ceb91f402d274b7ba8f29
SHA1

0ff2ec8ac5641dda2e906e7c746541ddeaaf9d8d
SHA256

2e684c176fd28742fa4afd4092f7cc25fc5f3d8a9589f52c632dbb25903dc868
SHA512

78150f98b445593479fdc8c269bd161266927908c48a0041b40c1dd1a3910d0f61f88fcccb51fb4724ee3cea3ce6ccb4157e78c5aee43b4fd428d14bfc34579b
SSDEEP

3072:scUKou4XrrY9akkkkkkknZZo4QQQQQQQkQ6i1ZVhXyaOVrZt7jEUnE/LtVLq:shbrr0e6i1ZVhXya2dt7jEUnE/Lts

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\96591260864ceb91f402d274b7ba8f29_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\96591260864ceb91f402d274b7ba8f29_JaffaCakes118.dll,#1
  2⤵
  PID:1792