19faa5fff1d3e911fe10e2ba4bc7a06ec200a03b1683043a2cc81c8bfa49066d

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 12:32

Target

0886b80f8a0a8c4524088b7b22f8c7e0_JaffaCakes118.dll
Size

28KB
MD5

0886b80f8a0a8c4524088b7b22f8c7e0
SHA1

7e0f58114daefd5510170b858e508c9e144a0bfd
SHA256

19faa5fff1d3e911fe10e2ba4bc7a06ec200a03b1683043a2cc81c8bfa49066d
SHA512

1f4774da20a1ce1e25d579033a73c68c7dc548c66cf53c49ee76e240d62ba976d9837863d4807fefbe50c098815695b81e09b88b4f5c407d76ac0c255e52ea47
SSDEEP

384:wCOakr/tFPecEISvwsDP/xnkcJVqWWIH6WiWIH6WMt0:wOi/tFPe1v7DP/xnkcJVqwIJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2180	2364	rundll32.exe	28
PID 2364 wrote to memory of 2180	2364	rundll32.exe	28
PID 2364 wrote to memory of 2180	2364	rundll32.exe	28
PID 2364 wrote to memory of 2180	2364	rundll32.exe	28
PID 2364 wrote to memory of 2180	2364	rundll32.exe	28
PID 2364 wrote to memory of 2180	2364	rundll32.exe	28
PID 2364 wrote to memory of 2180	2364	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0886b80f8a0a8c4524088b7b22f8c7e0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0886b80f8a0a8c4524088b7b22f8c7e0_JaffaCakes118.dll,#1
  2⤵
  PID:2180