8a2271f297712c3b2d96cb693620b3702449dfa7094270288fc53d08ac528307

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 23:38

Target

0ff35c408061781269fbc3104c36df20_JaffaCakes118.dll
Size

105KB
MD5

0ff35c408061781269fbc3104c36df20
SHA1

3af8b1766c94f8dce1a2832ee9fea66878257ad9
SHA256

8a2271f297712c3b2d96cb693620b3702449dfa7094270288fc53d08ac528307
SHA512

01abd00cdfa2ebf489d464befba92e8b63acca58eb622226f00529bcfd4b3c0b01324f7964d13712e1c2e42e40c323f3bcd2b0a3ead97ad6f9f8c2a38980855c
SSDEEP

1536:UOXqy6qTF8WN3wu+94pO0kI8HGcrxBSAFJzj4HTznYSygAolDfw/LcRY:FHnfkI8HGclwAFiAZoR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1884	1752	rundll32.exe	28
PID 1752 wrote to memory of 1884	1752	rundll32.exe	28
PID 1752 wrote to memory of 1884	1752	rundll32.exe	28
PID 1752 wrote to memory of 1884	1752	rundll32.exe	28
PID 1752 wrote to memory of 1884	1752	rundll32.exe	28
PID 1752 wrote to memory of 1884	1752	rundll32.exe	28
PID 1752 wrote to memory of 1884	1752	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ff35c408061781269fbc3104c36df20_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ff35c408061781269fbc3104c36df20_JaffaCakes118.dll,#1
  2⤵
  PID:1884