c0deb0467571a78e0f04512d191ebafcd12a9dd2592ff1bac24ead88dec640a4

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 07:54

Target

074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll
Size

34KB
MD5

074ccfbe57af087ef3fa8263e0e75a11
SHA1

9d3045f6f60ac0293e1bf3400253ef7352d0497e
SHA256

c0deb0467571a78e0f04512d191ebafcd12a9dd2592ff1bac24ead88dec640a4
SHA512

e189ae51e267552c5f3cd6438e73da99a0f62b091378d3f648e85452c127f5930584429d496564ea0d5b6bffd9517cb904097206040098400df14147fbed02d4
SSDEEP

768:vEWxQAkJg+wUQ74zmS8pk/sAq7IImTW6uJfljwu1j:MWeEGQ7ymSOapqnhJNjwi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 1716	1196	rundll32.exe	28
PID 1196 wrote to memory of 1716	1196	rundll32.exe	28
PID 1196 wrote to memory of 1716	1196	rundll32.exe	28
PID 1196 wrote to memory of 1716	1196	rundll32.exe	28
PID 1196 wrote to memory of 1716	1196	rundll32.exe	28
PID 1196 wrote to memory of 1716	1196	rundll32.exe	28
PID 1196 wrote to memory of 1716	1196	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1
  2⤵
  PID:1716