f744fed4694b777a96ca11fde65a8d73458f78361fff7fbbf4bcccb2b9679dcd

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 19:03

Target

0a4e158775d77fd432b531f564ae072d_JaffaCakes118.dll
Size

72KB
MD5

0a4e158775d77fd432b531f564ae072d
SHA1

05cfc640f8a1d9ffa6cd9137c86eb3929321b480
SHA256

f744fed4694b777a96ca11fde65a8d73458f78361fff7fbbf4bcccb2b9679dcd
SHA512

88ae048560fbf710f0dbe063117af85c4a714a6fdeddbb65acbe7ee97d53d8a8d64a12859058f23028fbb414fba1b43dca1135f32971e11a0b2b22b36df526bf
SSDEEP

1536:fn6otFOrDFIiELdMFtpRlkFnQxgxCnTL2Oc2rD:fnttgDFIhLdMrJk9QZ/2Oc2X

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2836	2172	rundll32.exe	28
PID 2172 wrote to memory of 2836	2172	rundll32.exe	28
PID 2172 wrote to memory of 2836	2172	rundll32.exe	28
PID 2172 wrote to memory of 2836	2172	rundll32.exe	28
PID 2172 wrote to memory of 2836	2172	rundll32.exe	28
PID 2172 wrote to memory of 2836	2172	rundll32.exe	28
PID 2172 wrote to memory of 2836	2172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a4e158775d77fd432b531f564ae072d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a4e158775d77fd432b531f564ae072d_JaffaCakes118.dll,#1
  2⤵
  PID:2836