5641f47628889201bf8c995be74c71acfe05ffcb77f0999d7ce849427b6e86dc

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 15:16

Target

0e8bdfdc46d1e051bc5ab01659b9acee_JaffaCakes118.dll
Size

92KB
MD5

0e8bdfdc46d1e051bc5ab01659b9acee
SHA1

530d7544ef64ae9b3e45cd765035f07f48065a3f
SHA256

5641f47628889201bf8c995be74c71acfe05ffcb77f0999d7ce849427b6e86dc
SHA512

6a22fc43a796192a1e22d8f310fcdc9bef9d6d34abf14bfc05ab63a39b4ec0ea77ea86df302b1baa95456a3be74f4deb9172abeed539029956ae1591024e9e24
SSDEEP

768:aoPlJhT/mmXQsTB6NEJ35yIT9qzSmKEGiDCd0a1r6cfbk9JtsqOM+Q3VPmAgqQJR:aiJJJXbJlTYTnkrdTkvOSNHgQUUl46Q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 1964	2364	rundll32.exe	28
PID 2364 wrote to memory of 1964	2364	rundll32.exe	28
PID 2364 wrote to memory of 1964	2364	rundll32.exe	28
PID 2364 wrote to memory of 1964	2364	rundll32.exe	28
PID 2364 wrote to memory of 1964	2364	rundll32.exe	28
PID 2364 wrote to memory of 1964	2364	rundll32.exe	28
PID 2364 wrote to memory of 1964	2364	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e8bdfdc46d1e051bc5ab01659b9acee_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e8bdfdc46d1e051bc5ab01659b9acee_JaffaCakes118.dll,#1
  2⤵
  PID:1964