970a390b87322a4c0b4ca876ab10a2fe0816f78a79581626ac9df80c7b62126c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 20:22

Target

0f66c91ec7e196713d850bd4082ef134_JaffaCakes118.dll
Size

100KB
MD5

0f66c91ec7e196713d850bd4082ef134
SHA1

b6bbf88ac412419e6d802502c8202a3b64769e2a
SHA256

970a390b87322a4c0b4ca876ab10a2fe0816f78a79581626ac9df80c7b62126c
SHA512

440aeaa40c010d8947bdd7d7859ea14c32ca3e911868d661a826652fd6474d422aaa240e84ae3be431ebcc25f44c1f73830b00a02217178af5b089c4fd3c5692
SSDEEP

3072:v2DTv1alQzE+urw410XO51vAVUW+TJrLV:v2DTvMlAN46XO7AGhTX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2236	2028	rundll32.exe	28
PID 2028 wrote to memory of 2236	2028	rundll32.exe	28
PID 2028 wrote to memory of 2236	2028	rundll32.exe	28
PID 2028 wrote to memory of 2236	2028	rundll32.exe	28
PID 2028 wrote to memory of 2236	2028	rundll32.exe	28
PID 2028 wrote to memory of 2236	2028	rundll32.exe	28
PID 2028 wrote to memory of 2236	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f66c91ec7e196713d850bd4082ef134_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f66c91ec7e196713d850bd4082ef134_JaffaCakes118.dll,#1
  2⤵
  PID:2236