93cf80107b325646c0659eec26e9161ce47316f75d58c6e36ee056f5ac4ada4a

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 07:56

Target

0d498ceb561d51b0ca8b6e0619372c8f_JaffaCakes118.dll
Size

72KB
MD5

0d498ceb561d51b0ca8b6e0619372c8f
SHA1

9b91b8519a5ebab837a2de6a62edf92b6ae6ac6f
SHA256

93cf80107b325646c0659eec26e9161ce47316f75d58c6e36ee056f5ac4ada4a
SHA512

15fe276ef635362734a3acb43c26e8ebbea7412a7d8c84edce456618d1b7cde77341a261e644c901e68ad3a4b27afeb08156fc98cbfa34c606ed561376f544e4
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2232	1868	rundll32.exe	28
PID 1868 wrote to memory of 2232	1868	rundll32.exe	28
PID 1868 wrote to memory of 2232	1868	rundll32.exe	28
PID 1868 wrote to memory of 2232	1868	rundll32.exe	28
PID 1868 wrote to memory of 2232	1868	rundll32.exe	28
PID 1868 wrote to memory of 2232	1868	rundll32.exe	28
PID 1868 wrote to memory of 2232	1868	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d498ceb561d51b0ca8b6e0619372c8f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d498ceb561d51b0ca8b6e0619372c8f_JaffaCakes118.dll,#1
  2⤵
  PID:2232