7602af44927995ec37c0678d00984bc272ce2cd36c6d178f84fb4d4900158bc8

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 04:02

Target

18b5b0a7187d5a792b3916cd62496411_JaffaCakes118.dll
Size

33KB
MD5

18b5b0a7187d5a792b3916cd62496411
SHA1

453b8a4326ffd3726763d7cb46bb0c6390a69897
SHA256

7602af44927995ec37c0678d00984bc272ce2cd36c6d178f84fb4d4900158bc8
SHA512

609c751033b8bfd29c3257ffa4ff5dd44905265b59a8f4a49ff51ff2082792d7cb2ef235fbc3cf7b72b9892ce358bec9056c06f87fe5f3ff9df7202b85f620b1
SSDEEP

768:6l9VMsHmFUydEn1naf7sf02yNVOL1RA2I:6l9Vpzn1s7s02MqRLI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1960	2392	rundll32.exe	28
PID 2392 wrote to memory of 1960	2392	rundll32.exe	28
PID 2392 wrote to memory of 1960	2392	rundll32.exe	28
PID 2392 wrote to memory of 1960	2392	rundll32.exe	28
PID 2392 wrote to memory of 1960	2392	rundll32.exe	28
PID 2392 wrote to memory of 1960	2392	rundll32.exe	28
PID 2392 wrote to memory of 1960	2392	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\18b5b0a7187d5a792b3916cd62496411_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\18b5b0a7187d5a792b3916cd62496411_JaffaCakes118.dll,#1
  2⤵
  PID:1960