068bd8fa77af8b4ebf38a68123f00d8224d625fb6971b26dc223727417933866

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 11:17

Target

ae2b1d0e8d74eb14f3ae9cd9f52d0e7d_JaffaCakes118.dll
Size

192KB
MD5

ae2b1d0e8d74eb14f3ae9cd9f52d0e7d
SHA1

0ca1cf7fda92c20f0da99454888d9c3b3a0c30d5
SHA256

068bd8fa77af8b4ebf38a68123f00d8224d625fb6971b26dc223727417933866
SHA512

eb069a95bc0691715c0a06733b63a91be4f392b1f9d3447d368cec578c548219f247003dca21f39e867d774aa345a5d893029624cfd3a5be30ac5a717d76ec38
SSDEEP

3072:MNbpOnPsGqQTruHLD7RcQxKrrdNU0VAtrOpOOWxOv4Kn7qbjx7T/Hrm6:MNbqaLD7RcukVAtSQOWcgWqbV77Lm6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2764	2832	rundll32.exe	28
PID 2832 wrote to memory of 2764	2832	rundll32.exe	28
PID 2832 wrote to memory of 2764	2832	rundll32.exe	28
PID 2832 wrote to memory of 2764	2832	rundll32.exe	28
PID 2832 wrote to memory of 2764	2832	rundll32.exe	28
PID 2832 wrote to memory of 2764	2832	rundll32.exe	28
PID 2832 wrote to memory of 2764	2832	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae2b1d0e8d74eb14f3ae9cd9f52d0e7d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae2b1d0e8d74eb14f3ae9cd9f52d0e7d_JaffaCakes118.dll,#1
  2⤵
  PID:2764