d54a18e2eca0c4b86e33c510c3a230ba6a74657e9ac4a98a79c0007a6de97f57

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 01:04

Target

0baee913b0674d190a68571d59237241_JaffaCakes118.dll
Size

44KB
MD5

0baee913b0674d190a68571d59237241
SHA1

4aa6323ee3ba5e02d17c65b6f0139f8f89823602
SHA256

d54a18e2eca0c4b86e33c510c3a230ba6a74657e9ac4a98a79c0007a6de97f57
SHA512

ae17857c3616247d989088b6230f3cb951e5bb39eb81bcffdcfdcda72124029762127f68251ec8e18bf95be641db6a3460631a1a0fd854641680ed9df99d0823
SSDEEP

768:3AZmRe78WL0PoYWd0ICoGCYQQNBXpXH7M9EGpc+xBBQARQkcUmhHAM2n:3XeQSFdgGpc+xBBQARMUQS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2124	2036	rundll32.exe	28
PID 2036 wrote to memory of 2124	2036	rundll32.exe	28
PID 2036 wrote to memory of 2124	2036	rundll32.exe	28
PID 2036 wrote to memory of 2124	2036	rundll32.exe	28
PID 2036 wrote to memory of 2124	2036	rundll32.exe	28
PID 2036 wrote to memory of 2124	2036	rundll32.exe	28
PID 2036 wrote to memory of 2124	2036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0baee913b0674d190a68571d59237241_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0baee913b0674d190a68571d59237241_JaffaCakes118.dll,#1
  2⤵
  PID:2124