11bcb76db2d5d4747241a144580d6cd44e8f82e512747eabfb25a812eea11895

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 10:13

Target

050e4c788626a7c9610c60827515a31e_JaffaCakes118.dll
Size

33KB
MD5

050e4c788626a7c9610c60827515a31e
SHA1

ac97a86e4e8e9b6f78ac09df5044f499a9be20cd
SHA256

11bcb76db2d5d4747241a144580d6cd44e8f82e512747eabfb25a812eea11895
SHA512

defbb518d7964c1648ebe85e2c3f2f911e668b15e6a6e59670730ea4364124578aaab8d508d7376ba9d5332a2139699099d7d8d59d02cf8874ab7b8e04828804
SSDEEP

768:R7v1b7TDuSxa/0xyDcl27l5+uMSVOiuGROku9A:Rz1b9a/3A47l5+uVFRFu+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 572	1232	rundll32.exe	28
PID 1232 wrote to memory of 572	1232	rundll32.exe	28
PID 1232 wrote to memory of 572	1232	rundll32.exe	28
PID 1232 wrote to memory of 572	1232	rundll32.exe	28
PID 1232 wrote to memory of 572	1232	rundll32.exe	28
PID 1232 wrote to memory of 572	1232	rundll32.exe	28
PID 1232 wrote to memory of 572	1232	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\050e4c788626a7c9610c60827515a31e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\050e4c788626a7c9610c60827515a31e_JaffaCakes118.dll,#1
  2⤵
  PID:572