03d465ab90b4455d7204a88e892512d4ff788eefe407d16f46542645941f2458

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 14:11

Target

06b4cb8c26cd4dfadea1dac928438a80_JaffaCakes118.dll
Size

249KB
MD5

06b4cb8c26cd4dfadea1dac928438a80
SHA1

f61cebe3d3b66609427943c113f660527b2cbfd0
SHA256

03d465ab90b4455d7204a88e892512d4ff788eefe407d16f46542645941f2458
SHA512

d7ee46f93cb1adf6fd86a67885cab41335a029a39c87cb1a3fd664c004a4d56849fd464f4080a00b081e2559f3369fd44799aea74fe7d49787abd1720497a1d8
SSDEEP

3072:3pR/j8Mui4vNaJZEVU67FC52k99geYK4W6mHHvv7VCirTcmS5AIg01+WpgXXDrce:5ecdZElQ52klB4WLH7785dzVCaxNl8uu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2652	1420	rundll32.exe	28
PID 1420 wrote to memory of 2652	1420	rundll32.exe	28
PID 1420 wrote to memory of 2652	1420	rundll32.exe	28
PID 1420 wrote to memory of 2652	1420	rundll32.exe	28
PID 1420 wrote to memory of 2652	1420	rundll32.exe	28
PID 1420 wrote to memory of 2652	1420	rundll32.exe	28
PID 1420 wrote to memory of 2652	1420	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06b4cb8c26cd4dfadea1dac928438a80_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06b4cb8c26cd4dfadea1dac928438a80_JaffaCakes118.dll,#1
  2⤵
  PID:2652