98ed21c31e74f5815deebcf366d955b668622dca42c60df78116c0a6c3322ea4

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 04:52

Target

2121c2ede8aeb845b8daf76ed70b0c7e_JaffaCakes118.dll
Size

97KB
MD5

2121c2ede8aeb845b8daf76ed70b0c7e
SHA1

45a4a7f1361811b7c522043108d824a4e69e6eec
SHA256

98ed21c31e74f5815deebcf366d955b668622dca42c60df78116c0a6c3322ea4
SHA512

5a28194be358e425c6dd74b49e8c999eecd4e0327912b18e0be39b0befbf46c23989236cae6d4d61812913281ebeed65ad818d55d2def906f9127ccb3a59f4bf
SSDEEP

3072:YB2b+5Q3+PwDw2uWexZNssnfyw7zMQXFOjcFAlIE:Y0b+kw2CnL7QQ1GcFAl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2356	1724	rundll32.exe	28
PID 1724 wrote to memory of 2356	1724	rundll32.exe	28
PID 1724 wrote to memory of 2356	1724	rundll32.exe	28
PID 1724 wrote to memory of 2356	1724	rundll32.exe	28
PID 1724 wrote to memory of 2356	1724	rundll32.exe	28
PID 1724 wrote to memory of 2356	1724	rundll32.exe	28
PID 1724 wrote to memory of 2356	1724	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2121c2ede8aeb845b8daf76ed70b0c7e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2121c2ede8aeb845b8daf76ed70b0c7e_JaffaCakes118.dll,#1
  2⤵
  PID:2356