5755e253172a2824440d23b7cc41a302b2500e78c08488022b166dc493fff917

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 18:17

Target

0f0f3c02256a0495aab4fb84af87d20a_JaffaCakes118.dll
Size

186KB
MD5

0f0f3c02256a0495aab4fb84af87d20a
SHA1

b31c3af512f70eeda2ea984a5320a1b210f6fad5
SHA256

5755e253172a2824440d23b7cc41a302b2500e78c08488022b166dc493fff917
SHA512

45940ece26dbb9bcc4d81c8b0cf98042e6d4baf2c18bf73eba11c668b8100f0920c1f23d9055149f3b8fda2fc5a79622525d6cc4284ca35cca4d3a6c56ff675e
SSDEEP

3072:ziM13TBRiOvlrXnRw8PLF9jZUgpN1KEX65u6NLGkA3+WFYxe6:zi2BRiOxXRw8rZUG7KEVOSkk+WFO7

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2372	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2372	2104	rundll32.exe	28
PID 2104 wrote to memory of 2372	2104	rundll32.exe	28
PID 2104 wrote to memory of 2372	2104	rundll32.exe	28
PID 2104 wrote to memory of 2372	2104	rundll32.exe	28
PID 2104 wrote to memory of 2372	2104	rundll32.exe	28
PID 2104 wrote to memory of 2372	2104	rundll32.exe	28
PID 2104 wrote to memory of 2372	2104	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f0f3c02256a0495aab4fb84af87d20a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f0f3c02256a0495aab4fb84af87d20a_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2372