2e069f890878f1d8f216c06f26fdccab419741e4ba471ef8dbce00db5c0a9903

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 07:29

Target

27baecc814ce92871250ec00c1bb5a0d_JaffaCakes118.dll
Size

38KB
MD5

27baecc814ce92871250ec00c1bb5a0d
SHA1

7e84d9dccf1dc2d1592b1c510ae0189b7138731e
SHA256

2e069f890878f1d8f216c06f26fdccab419741e4ba471ef8dbce00db5c0a9903
SHA512

d9d4c8d5b902e3ab15145614165bd11c380c9ddfcdb8a1053b800d205e24276e8578c3163e09a13fc18ec6be6cfe65c9890eeb7c0d20bf63dcdd91cb81f091fd
SSDEEP

768:gQFDlc9dpTxwYTPnGWawMQMVlqI63e11U/UNcllc:l9lc9dpTxXTPhawrMjqO11rNcllc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2096	1620	rundll32.exe	30
PID 1620 wrote to memory of 2096	1620	rundll32.exe	30
PID 1620 wrote to memory of 2096	1620	rundll32.exe	30
PID 1620 wrote to memory of 2096	1620	rundll32.exe	30
PID 1620 wrote to memory of 2096	1620	rundll32.exe	30
PID 1620 wrote to memory of 2096	1620	rundll32.exe	30
PID 1620 wrote to memory of 2096	1620	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27baecc814ce92871250ec00c1bb5a0d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27baecc814ce92871250ec00c1bb5a0d_JaffaCakes118.dll,#1
  2⤵
  PID:2096