1e06c6f9df149726473899c6afab6996f18721e2fdaa3cbb63b583d28f300140

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 17:22

Target

09d57ecbab444a3105695edb2ea5d8a7_JaffaCakes118.dll
Size

272KB
MD5

09d57ecbab444a3105695edb2ea5d8a7
SHA1

a5465acd7372a5b63d3ecd6d252de7440f20d05e
SHA256

1e06c6f9df149726473899c6afab6996f18721e2fdaa3cbb63b583d28f300140
SHA512

241e0aba1755d6c53edd24fb857f739bd47ca0409c493cbac9f40b40875fc8fdc797f7a04b44517f1a850b34d36863d3ef5444abc064f6373c75cc5fcb109af1
SSDEEP

3072:i26re9bDtVeIEpu4c6nvpL1Hd41DBWEqS33sqdw4qM+ptR20V75AnQTBfRAzQh/9:iTMb+pf/AUv4WDJbAnQTBJ9hlE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 348	1796	rundll32.exe	28
PID 1796 wrote to memory of 348	1796	rundll32.exe	28
PID 1796 wrote to memory of 348	1796	rundll32.exe	28
PID 1796 wrote to memory of 348	1796	rundll32.exe	28
PID 1796 wrote to memory of 348	1796	rundll32.exe	28
PID 1796 wrote to memory of 348	1796	rundll32.exe	28
PID 1796 wrote to memory of 348	1796	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09d57ecbab444a3105695edb2ea5d8a7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09d57ecbab444a3105695edb2ea5d8a7_JaffaCakes118.dll,#1
  2⤵
  PID:348