cb7942fbae30e7de06cf220a43f57e97f61f98c58596db65f6a3ae4f884984a4

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 14:56

Target

166b53fa6b58a0a10ce7f4e96611ae4c_JaffaCakes118.dll
Size

176KB
MD5

166b53fa6b58a0a10ce7f4e96611ae4c
SHA1

8b67a9398f9e6c877220313b79c44ccdfc910bee
SHA256

cb7942fbae30e7de06cf220a43f57e97f61f98c58596db65f6a3ae4f884984a4
SHA512

2063e3643911cb2a6805f5b4de06ced1f3da8daa832a0a03d776c5a0cbe90268a18045fdf87b1cf89ec2b7c92316bd19e43a42bffe3b19274f1b86546d377b26
SSDEEP

3072:0FzhA4pNcczuaTBEOyRrkAe5sBVBacE75mn2lsdbRbR7z+LTBf/8Xkj9:Cd1pytkANiWJ+LTBH8X

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1992	1688	rundll32.exe	28
PID 1688 wrote to memory of 1992	1688	rundll32.exe	28
PID 1688 wrote to memory of 1992	1688	rundll32.exe	28
PID 1688 wrote to memory of 1992	1688	rundll32.exe	28
PID 1688 wrote to memory of 1992	1688	rundll32.exe	28
PID 1688 wrote to memory of 1992	1688	rundll32.exe	28
PID 1688 wrote to memory of 1992	1688	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\166b53fa6b58a0a10ce7f4e96611ae4c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\166b53fa6b58a0a10ce7f4e96611ae4c_JaffaCakes118.dll,#1
  2⤵
  PID:1992