db952761f0265c905a89528510303a764d3f35088c8c6b9770eaffafb9f41bde

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 11:27

Target

05916e434ca6bc3a5d08310c15c72839_JaffaCakes118.dll
Size

16KB
MD5

05916e434ca6bc3a5d08310c15c72839
SHA1

55f13deee4ffc652a51d0cf8affd33e87c28e338
SHA256

db952761f0265c905a89528510303a764d3f35088c8c6b9770eaffafb9f41bde
SHA512

a9e202cf2787c7a70cf63139528b280d2cdbe1118bdf1e93b3d7b4489091172890a87ecc48391b852b5923fb62e12dabe21d670e9b28909055c44121d6678bb8
SSDEEP

384:NjPwjZ/1e0e7eEe1eQsFN3+LTXIuBBQARQkIlL838:Nj627KroQukLTXfBBQARQkIlL4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 1540	2140	rundll32.exe	28
PID 2140 wrote to memory of 1540	2140	rundll32.exe	28
PID 2140 wrote to memory of 1540	2140	rundll32.exe	28
PID 2140 wrote to memory of 1540	2140	rundll32.exe	28
PID 2140 wrote to memory of 1540	2140	rundll32.exe	28
PID 2140 wrote to memory of 1540	2140	rundll32.exe	28
PID 2140 wrote to memory of 1540	2140	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05916e434ca6bc3a5d08310c15c72839_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05916e434ca6bc3a5d08310c15c72839_JaffaCakes118.dll,#1
  2⤵
  PID:1540