622f1d61c0b7026198771eb9043e9043186ce261ac496badee3ece1aa4fd1a04

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 19:00

Target

08e1aba37d6ecb2dcc7c0c6e78612bb2_JaffaCakes118.dll
Size

66KB
MD5

08e1aba37d6ecb2dcc7c0c6e78612bb2
SHA1

147bdba6d51b562664f5ffec019558249fdef4cf
SHA256

622f1d61c0b7026198771eb9043e9043186ce261ac496badee3ece1aa4fd1a04
SHA512

493c0ed22f1b18e006c21b24503f356a42af30e438602f87d594f232f5b1c8ed2317829612f2493449f6fa26864cc6a8ee6b675f3d49d715c53136e1ea5cdd62
SSDEEP

1536:kjRUhEcwwtMwFiQ8iBWw9Xj2HKryiBgqNZ9Eg/ycEW7TpdPwIHv:kF+IwF8HGSHKrbgA9E3Kn8o

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1980	1776	rundll32.exe	28
PID 1776 wrote to memory of 1980	1776	rundll32.exe	28
PID 1776 wrote to memory of 1980	1776	rundll32.exe	28
PID 1776 wrote to memory of 1980	1776	rundll32.exe	28
PID 1776 wrote to memory of 1980	1776	rundll32.exe	28
PID 1776 wrote to memory of 1980	1776	rundll32.exe	28
PID 1776 wrote to memory of 1980	1776	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08e1aba37d6ecb2dcc7c0c6e78612bb2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\08e1aba37d6ecb2dcc7c0c6e78612bb2_JaffaCakes118.dll,#1
  2⤵
  PID:1980