bd7a65db8ec3ad106172933ef9c9519b7173fec59b121a253e56dccb4db67062

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 22:01

Target

0ad8bf5b045dd500f7373912847c5c4e_JaffaCakes118.dll
Size

279KB
MD5

0ad8bf5b045dd500f7373912847c5c4e
SHA1

d877f8dcda985e34d62ddcba42407bbbfbb51267
SHA256

bd7a65db8ec3ad106172933ef9c9519b7173fec59b121a253e56dccb4db67062
SHA512

923b95f3144e0744aa1d61d57b6f3447369f576f29e79c8bf192a9fb139c5e3993d817381805c4425f5b6b461965a3d5b4d30f4d0ccadbba557a798c1c156ff8
SSDEEP

3072:OHG3hivYmS6SstwIeCRB5FEimt78j9vpT9n3uqrzRPi+cKIVpaJDcr6L47WR+qi9:KGxxalwwnenVEDMaEWR+qiGB0K

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2372	2980	rundll32.exe	28
PID 2980 wrote to memory of 2372	2980	rundll32.exe	28
PID 2980 wrote to memory of 2372	2980	rundll32.exe	28
PID 2980 wrote to memory of 2372	2980	rundll32.exe	28
PID 2980 wrote to memory of 2372	2980	rundll32.exe	28
PID 2980 wrote to memory of 2372	2980	rundll32.exe	28
PID 2980 wrote to memory of 2372	2980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ad8bf5b045dd500f7373912847c5c4e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ad8bf5b045dd500f7373912847c5c4e_JaffaCakes118.dll,#1
  2⤵
  PID:2372