d4faaa3d811d767b659e5b529c14dad74373bbeebfb8dfb81c560f89430fd8f3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 12:02

Target

1a0b069385350912365581118e100739_JaffaCakes118.dll
Size

81KB
MD5

1a0b069385350912365581118e100739
SHA1

04fc44fb195c43d358acc02932781515071c22c3
SHA256

d4faaa3d811d767b659e5b529c14dad74373bbeebfb8dfb81c560f89430fd8f3
SHA512

23d712cffd6488c3e0d3b4aecdd4fb5832b5cb5b1364af1cc73ac4f8c8b990d38a5d7fdd7302a4d8a5262a935ef52a8c8c30c59fc6401c479542e1df16f4121e
SSDEEP

1536:lNqVe0dfQBL9sjZrSdKWMkpY+lvBhBvRugZ8JCr1JN5YRjhniGtZzrLm:LqoOQQjZ/WM09hlR9Ck1JjYRHXzm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28
PID 2868 wrote to memory of 2884	2868	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a0b069385350912365581118e100739_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a0b069385350912365581118e100739_JaffaCakes118.dll,#1
  2⤵
  PID:2884