19b07e70de173db383bd00dc3b2eb96df3d3007860728cf5abad420ee2053e08

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 17:58

Target

23443b961ccf95b62fcefd27eda6aaff_JaffaCakes118.dll
Size

128KB
MD5

23443b961ccf95b62fcefd27eda6aaff
SHA1

092172d6fd15cc45bdab7248a7d108e9d3a4ba77
SHA256

19b07e70de173db383bd00dc3b2eb96df3d3007860728cf5abad420ee2053e08
SHA512

7347cbf6e519c287fce1b1c09369363de5c08a0abeda0534df51dc079b4de46eba084cab976794101fd49feb85480ab550bc071340ee9fc3c373b09283f80a78
SSDEEP

3072:zPq3nLxBj9mQFAwc1OADLQ65xzFNH2vhtRY7lIIzAOO:DGLAQFAwuLhx5NH2J8ymfO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2372	2368	rundll32.exe	28
PID 2368 wrote to memory of 2372	2368	rundll32.exe	28
PID 2368 wrote to memory of 2372	2368	rundll32.exe	28
PID 2368 wrote to memory of 2372	2368	rundll32.exe	28
PID 2368 wrote to memory of 2372	2368	rundll32.exe	28
PID 2368 wrote to memory of 2372	2368	rundll32.exe	28
PID 2368 wrote to memory of 2372	2368	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23443b961ccf95b62fcefd27eda6aaff_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23443b961ccf95b62fcefd27eda6aaff_JaffaCakes118.dll,#1
  2⤵
  PID:2372