92cee38b78b849dbe5214c6c29eeefe43c1a0c088500b06ca2702c6c28830259

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 01:56

Target

185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll
Size

172KB
MD5

185f736a606a34373919f6e16ae1b68d
SHA1

071a01c2654103f3fc86475cb45a84ae82fcd850
SHA256

92cee38b78b849dbe5214c6c29eeefe43c1a0c088500b06ca2702c6c28830259
SHA512

849edd87d206f08d77f3543c687fa4090cee23f637e9f3ce38935db18ea8d98207de20b487c73e34c345090cfa31db914be3dc3e71574bd864ce76ecfd680acb
SSDEEP

3072:QT4wiMOULEYbsD78pcQrQmXo4jrM2iQlWdQ21UEE//fnEdwiuTsALG5hVa7Ywb//:QEwiMOuE5D76vQrUkQlqn1Uj/fji3ecm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1188	848	rundll32.exe	28
PID 848 wrote to memory of 1188	848	rundll32.exe	28
PID 848 wrote to memory of 1188	848	rundll32.exe	28
PID 848 wrote to memory of 1188	848	rundll32.exe	28
PID 848 wrote to memory of 1188	848	rundll32.exe	28
PID 848 wrote to memory of 1188	848	rundll32.exe	28
PID 848 wrote to memory of 1188	848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1
  2⤵
  PID:1188