9cb601d3caa4e61ace40fcf694d7423f3f614ee9adcb15afc17892eac0b84bcb

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 23:12

Target

269441b4404553f3cc2fc55c2a23df0c_JaffaCakes118.dll
Size

62KB
MD5

269441b4404553f3cc2fc55c2a23df0c
SHA1

5bcd3a90166c3e16bb9675defe5ea266e87b46f5
SHA256

9cb601d3caa4e61ace40fcf694d7423f3f614ee9adcb15afc17892eac0b84bcb
SHA512

352de1371f35260a6b080c002f7387b27cbd94def79f7a228b0468d7f3070017ba23d34b8f38d2bcbb75bbe8c4c16671361d4b7c1476d0679fdcfc2721f8ecdf
SSDEEP

1536:/5ecr7bA05eJvW8dflYDOXfjf9m3DQl93a7qLSNWn9j8:B7s05MvW8dflYmfJaEDa2WIn9j8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 844	2476	rundll32.exe	30
PID 2476 wrote to memory of 844	2476	rundll32.exe	30
PID 2476 wrote to memory of 844	2476	rundll32.exe	30
PID 2476 wrote to memory of 844	2476	rundll32.exe	30
PID 2476 wrote to memory of 844	2476	rundll32.exe	30
PID 2476 wrote to memory of 844	2476	rundll32.exe	30
PID 2476 wrote to memory of 844	2476	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\269441b4404553f3cc2fc55c2a23df0c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\269441b4404553f3cc2fc55c2a23df0c_JaffaCakes118.dll,#1
  2⤵
  PID:844