5636e242cb23f92db9b0c5211c176182daf617fc230c3fb53cd5a1274d1c46d3

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 05:16

Target

21302f4c2cb6b3dc8cb18e5252bd26b9_JaffaCakes118.dll
Size

63KB
MD5

21302f4c2cb6b3dc8cb18e5252bd26b9
SHA1

441499e23e0105a05bd45f0ae1f6f4650e026fc7
SHA256

5636e242cb23f92db9b0c5211c176182daf617fc230c3fb53cd5a1274d1c46d3
SHA512

fdae984a03581f6bacbced6f2493e7218a54433ff2ef3554b254644cac8d56d707cb2b7772d403821f3553b93b1edd31f94d5206c6b45851597133ddb5795bd9
SSDEEP

1536:pDAZqF5L3ujqZVk1FbE0ScQyAHcpV7vs1ULLAKOaRnRD:pXn2zbrSc/AaV41ULsKOaRnR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21302f4c2cb6b3dc8cb18e5252bd26b9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21302f4c2cb6b3dc8cb18e5252bd26b9_JaffaCakes118.dll,#1
  2⤵
  PID:2092