99aad8c264c48a9d3a43f48b66362c9b9b0cc865514d6626a84a54b46505f4df

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 08:53

Target

19859efefaeb78eee025416f5c681a1b_JaffaCakes118.dll
Size

133KB
MD5

19859efefaeb78eee025416f5c681a1b
SHA1

25633640668437cef02d0934a625cdcaa0f566a0
SHA256

99aad8c264c48a9d3a43f48b66362c9b9b0cc865514d6626a84a54b46505f4df
SHA512

801874a1736dfa41f520135f3506998ed0f11b54e7163e4b12486c35daf7452fc87c6872b8800bf413ecca5f15621aa582ecc90a897bbbeb363ae97c01fa52e2
SSDEEP

3072:2foFnzrLXJ74JP/A34j3RV46KOXkILajU0J+2XhrjXTLj:2foVzrLXh4JLjmOBajU0J+2RXT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2408	2020	rundll32.exe	28
PID 2020 wrote to memory of 2408	2020	rundll32.exe	28
PID 2020 wrote to memory of 2408	2020	rundll32.exe	28
PID 2020 wrote to memory of 2408	2020	rundll32.exe	28
PID 2020 wrote to memory of 2408	2020	rundll32.exe	28
PID 2020 wrote to memory of 2408	2020	rundll32.exe	28
PID 2020 wrote to memory of 2408	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\19859efefaeb78eee025416f5c681a1b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\19859efefaeb78eee025416f5c681a1b_JaffaCakes118.dll,#1
  2⤵
  PID:2408