b29023717392c0b24753b756694e43e873ebe71d32c6b86e1a8fd262d48758e1

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 20:54

Target

177cbb037d0a675ddcd3e707fc3a0810_JaffaCakes118.dll
Size

248KB
MD5

177cbb037d0a675ddcd3e707fc3a0810
SHA1

c78739d9e4420a5d4b7deca1be12377c593d30ab
SHA256

b29023717392c0b24753b756694e43e873ebe71d32c6b86e1a8fd262d48758e1
SHA512

717ad662242423b2162f98607abdf0f8122921b95ad42a0823af52bafe78f5f09cafb4d60edb8421b5f44636f346bfc01892470b7bbb5544265b1b6be0b32b38
SSDEEP

6144:0EMnUUUTGv/Dd5H/4WUYtdnQ3AoQeeaQeeQQeesQeerZQeehQeebNcBVZ8TVMIsq:ixx4WUYs2ceZn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2224	2220	rundll32.exe	28
PID 2220 wrote to memory of 2224	2220	rundll32.exe	28
PID 2220 wrote to memory of 2224	2220	rundll32.exe	28
PID 2220 wrote to memory of 2224	2220	rundll32.exe	28
PID 2220 wrote to memory of 2224	2220	rundll32.exe	28
PID 2220 wrote to memory of 2224	2220	rundll32.exe	28
PID 2220 wrote to memory of 2224	2220	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\177cbb037d0a675ddcd3e707fc3a0810_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\177cbb037d0a675ddcd3e707fc3a0810_JaffaCakes118.dll,#1
  2⤵
  PID:2224