42c1ceb2c04c2f7d781ddd4325d55a6b45f4d25490a0ce65cdf7b0fac8283bba

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 07:31

Target

0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll
Size

162KB
MD5

0f25a3cd7d33ca394c80f511e30df31c
SHA1

0ae4a5e588df2b0d07582683a4540f7a975c0700
SHA256

42c1ceb2c04c2f7d781ddd4325d55a6b45f4d25490a0ce65cdf7b0fac8283bba
SHA512

64bb8cdd4c9d95d01925688ce34795cadbf529c775daef8dd2a4f16277e4f815e2097f34d7abb78b94b6545c1809e1a102773cb39f4fa7f747dcad61392d6543
SSDEEP

3072:JX/VvZy8cwFhnAEzp/KFN/uX8FqxmW5F8U927fwbB2dSgypMZg5tmuSeyZjr:JXNhy87nAU/K2XKqAW5Fy1Sag/gr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28
PID 1148 wrote to memory of 2256	1148	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1
  2⤵
  PID:2256