a0e965a37c956e73e98641b4e3225a52b2845be370c252047f9f9005e69cd8eb

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 12:33

Target

0e166728a15566b707b6f14ac018fdf8_JaffaCakes118.dll
Size

140KB
MD5

0e166728a15566b707b6f14ac018fdf8
SHA1

dc4604542428e50278927255219e675a5a00fefe
SHA256

a0e965a37c956e73e98641b4e3225a52b2845be370c252047f9f9005e69cd8eb
SHA512

1229284fd9aec56a21dd80a2c45763f84c9c00c3872f8031dd1744e987e8eeec008704e0f9ee1a86b377541589d7cb5eb6ded7181a67d80a16e59d9abba21c9f
SSDEEP

3072:LeHjq76AK+48/waKuCLnVw8YraJ2TYg3ut35XIOxG2Sqy3S6rfI:KjoKu7kR2fQN60

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2060	2284	rundll32.exe	28
PID 2284 wrote to memory of 2060	2284	rundll32.exe	28
PID 2284 wrote to memory of 2060	2284	rundll32.exe	28
PID 2284 wrote to memory of 2060	2284	rundll32.exe	28
PID 2284 wrote to memory of 2060	2284	rundll32.exe	28
PID 2284 wrote to memory of 2060	2284	rundll32.exe	28
PID 2284 wrote to memory of 2060	2284	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e166728a15566b707b6f14ac018fdf8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e166728a15566b707b6f14ac018fdf8_JaffaCakes118.dll,#1
  2⤵
  PID:2060