0ad0f14139d5bef4477b165d399d78d04b34a1a54dd468c432b6d33b8eeb375a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 05:23

Target

b6f5705b1b8b9d856e1998ea56fc6ddf_JaffaCakes118.dll
Size

14KB
MD5

b6f5705b1b8b9d856e1998ea56fc6ddf
SHA1

04ba3b85611a84166efc6b4c4d360b7489207734
SHA256

0ad0f14139d5bef4477b165d399d78d04b34a1a54dd468c432b6d33b8eeb375a
SHA512

5c628398676b0bf6d93e907fe638454c45639d4cc954e7940b1d65fa15c3b28b0e6a37765a0d4b578b91d3bb3ff99c1faed2995412d4a39e6259abd96943bf6a
SSDEEP

384:Jw7vrbhtZR8xZAsH9qq4mgGjwZuP7oGCazHqRNPmaPyt:yTGfCauFPE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 3012	2848	rundll32.exe	28
PID 2848 wrote to memory of 3012	2848	rundll32.exe	28
PID 2848 wrote to memory of 3012	2848	rundll32.exe	28
PID 2848 wrote to memory of 3012	2848	rundll32.exe	28
PID 2848 wrote to memory of 3012	2848	rundll32.exe	28
PID 2848 wrote to memory of 3012	2848	rundll32.exe	28
PID 2848 wrote to memory of 3012	2848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6f5705b1b8b9d856e1998ea56fc6ddf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6f5705b1b8b9d856e1998ea56fc6ddf_JaffaCakes118.dll,#1
  2⤵
  PID:3012