9870900d92c80afb088ba9bafdf96f55f16017adeb4b3cdbfd18d484288362fd

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 17:59

Target

0f02b916530727976efbd52a000255d4_JaffaCakes118.dll
Size

737KB
MD5

0f02b916530727976efbd52a000255d4
SHA1

a55376d3d5e29092805b48741ecb73a4040ab6b3
SHA256

9870900d92c80afb088ba9bafdf96f55f16017adeb4b3cdbfd18d484288362fd
SHA512

2d65e034929f90b41641639503449731c231cdf9e2bb098cb584ab17ba19d30a770cc8af2319143e246a6aee8f43ae5cdadf19a2d129cb8aee4a68c1b1e692d8
SSDEEP

12288:Cu6iSe70DWSFAID02lbnkhF5dtSWD4t2F1sDw0P2NtCEodvWs6N7WSsoZJcw:Cu6iveW1ID0cDkhFftrD2xZMCEodvt6V

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1900	1636	rundll32.exe	28
PID 1636 wrote to memory of 1900	1636	rundll32.exe	28
PID 1636 wrote to memory of 1900	1636	rundll32.exe	28
PID 1636 wrote to memory of 1900	1636	rundll32.exe	28
PID 1636 wrote to memory of 1900	1636	rundll32.exe	28
PID 1636 wrote to memory of 1900	1636	rundll32.exe	28
PID 1636 wrote to memory of 1900	1636	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f02b916530727976efbd52a000255d4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f02b916530727976efbd52a000255d4_JaffaCakes118.dll,#1
  2⤵
  PID:1900