db7c787825a0309b5d178691cc41712c34a4a9ad2de782f8707107880b4e0df5

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 18:36

Target

08b341403da2d51f791268e4855beab4_JaffaCakes118.dll
Size

26KB
MD5

08b341403da2d51f791268e4855beab4
SHA1

a2c0f3566a241d38a664979799f4d1ac31bf3b18
SHA256

db7c787825a0309b5d178691cc41712c34a4a9ad2de782f8707107880b4e0df5
SHA512

19fb972ddd05388c458255e56ea19c278f23bbd742bb2ceda55a0c2024082bfcc183560c4e9eb38c6ae788978a886a72ba0fde3b8d588e744cf969de51d169c0
SSDEEP

384:1j0MlPs+n/dFRxiCMvFiVywLOn1P0CJD0AZKQBjdq2hRjiMiJWDSp7WgkbZy:h0Ml3/IFiV7UPnJD0cjPjjKWDSBZkbZy

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08b341403da2d51f791268e4855beab4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\08b341403da2d51f791268e4855beab4_JaffaCakes118.dll,#1
  2⤵
  PID:3024