a093015600887c8739d530c63b3e1c1356ba5631c8bb6fdf5fd09c89e064f7da

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 14:12

Target

0e5f89babb15a5ce7df9419d56eb6cb2_JaffaCakes118.dll
Size

33KB
MD5

0e5f89babb15a5ce7df9419d56eb6cb2
SHA1

aea1a89e41cc6b21ee429d136d84cdc9a4b774ce
SHA256

a093015600887c8739d530c63b3e1c1356ba5631c8bb6fdf5fd09c89e064f7da
SHA512

9a7d3e0511f2cf3900d0b56da168146a07419e7a8be6a63bf7fe4d99f33725cb5e8bb70ed1a2c0b211687abc41dab6637510cd579e27d952c1f26e538027b7ee
SSDEEP

768:H7v1b7TDuSxa/0xyDcl27l5+uMSVOiuGROku9A:Hz1b9a/3A47l5+uVFRFu+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1272	2196	rundll32.exe	28
PID 2196 wrote to memory of 1272	2196	rundll32.exe	28
PID 2196 wrote to memory of 1272	2196	rundll32.exe	28
PID 2196 wrote to memory of 1272	2196	rundll32.exe	28
PID 2196 wrote to memory of 1272	2196	rundll32.exe	28
PID 2196 wrote to memory of 1272	2196	rundll32.exe	28
PID 2196 wrote to memory of 1272	2196	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e5f89babb15a5ce7df9419d56eb6cb2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e5f89babb15a5ce7df9419d56eb6cb2_JaffaCakes118.dll,#1
  2⤵
  PID:1272