3bced6637ab2cfdc5ae70acb88a7e434019aeb13e9b927585ac148ccffe5e21a

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 07:59

Target

27d16ea99dfd32ceb1b2622a393d8823_JaffaCakes118.dll
Size

97KB
MD5

27d16ea99dfd32ceb1b2622a393d8823
SHA1

e7567ebefa3d98cd65ca3db6c2a7bd7448248e5d
SHA256

3bced6637ab2cfdc5ae70acb88a7e434019aeb13e9b927585ac148ccffe5e21a
SHA512

249c94f16fa46e474cfba899a7144cb4d145a6e33bbd18aec4df9c56abbe0af7c7c860791602d9103debfbe057de2c5cc102a97778e7f6bac2411f6633fb4903
SSDEEP

1536:pOAlMYlIo6oIjH7JG8gjbtoOL2uh8Of5EAQn91a13T3Rm8LO95O/nwAy40J4:MAz+tnk84OUSx9YQ8q95O/L0J

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1740	2208	rundll32.exe	28
PID 2208 wrote to memory of 1740	2208	rundll32.exe	28
PID 2208 wrote to memory of 1740	2208	rundll32.exe	28
PID 2208 wrote to memory of 1740	2208	rundll32.exe	28
PID 2208 wrote to memory of 1740	2208	rundll32.exe	28
PID 2208 wrote to memory of 1740	2208	rundll32.exe	28
PID 2208 wrote to memory of 1740	2208	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27d16ea99dfd32ceb1b2622a393d8823_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27d16ea99dfd32ceb1b2622a393d8823_JaffaCakes118.dll,#1
  2⤵
  PID:1740