e226a9e39656ea59326ccffd63be158f764d274efcb728974094836cb6ace250

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 13:08

Target

1a3c88df2069ada8964b78b9bdac9fc5_JaffaCakes118.dll
Size

132KB
MD5

1a3c88df2069ada8964b78b9bdac9fc5
SHA1

350b15026a04a3d19e08c9159abed99936a9e7fb
SHA256

e226a9e39656ea59326ccffd63be158f764d274efcb728974094836cb6ace250
SHA512

caac97357f8eeed17b117c31f6d512b737850c8900de6e43e0bbf637649aba7d24bd23d45a7059f84d22b822af3d1cbae8a03c2456446037bfc9db1ba39f8e78
SSDEEP

3072:3ffqwt4wIqYhb5tgGVTZO65z4PepoCDQV7xmM0pI56ghOjMFlkHGe2:3KweW00GhIL7MZI53Ojc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2584	2328	rundll32.exe	28
PID 2328 wrote to memory of 2584	2328	rundll32.exe	28
PID 2328 wrote to memory of 2584	2328	rundll32.exe	28
PID 2328 wrote to memory of 2584	2328	rundll32.exe	28
PID 2328 wrote to memory of 2584	2328	rundll32.exe	28
PID 2328 wrote to memory of 2584	2328	rundll32.exe	28
PID 2328 wrote to memory of 2584	2328	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a3c88df2069ada8964b78b9bdac9fc5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a3c88df2069ada8964b78b9bdac9fc5_JaffaCakes118.dll,#1
  2⤵
  PID:2584