37a3fd53e4a1e7fb5f377271123c5c115851ae1f92912b6f79cb263d6fe79e19

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 22:59

Target

0106cf516fca017962bd0cf957861a45_JaffaCakes118.dll
Size

135KB
MD5

0106cf516fca017962bd0cf957861a45
SHA1

2ddf70ff0f2ed01e452e7dd36ccec6015ed0289c
SHA256

37a3fd53e4a1e7fb5f377271123c5c115851ae1f92912b6f79cb263d6fe79e19
SHA512

f8151bbf8c133172cb9d38392412276d3e6e1c4a843ea9f9d8184de9b947e85be6b1092fac8e9f573e29b9ead379bc7ebe0de1125cd6e811265a7cdb2e4cc2f4
SSDEEP

1536:nuSM379pilzy4aCUBGbrufhif3ba/Qtps4zWeYXuOtMla:nu79WdaC2urufq33UeYuOH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2836	2172	rundll32.exe	28
PID 2172 wrote to memory of 2836	2172	rundll32.exe	28
PID 2172 wrote to memory of 2836	2172	rundll32.exe	28
PID 2172 wrote to memory of 2836	2172	rundll32.exe	28
PID 2172 wrote to memory of 2836	2172	rundll32.exe	28
PID 2172 wrote to memory of 2836	2172	rundll32.exe	28
PID 2172 wrote to memory of 2836	2172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0106cf516fca017962bd0cf957861a45_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0106cf516fca017962bd0cf957861a45_JaffaCakes118.dll,#1
  2⤵
  PID:2836