541508503875a9aa694ed1a45045a545113f46163ba22ca70e45116cff2fac58

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 09:52

Target

281e68b84bd63930d6c4de7f2a406f1c_JaffaCakes118.dll
Size

96KB
MD5

281e68b84bd63930d6c4de7f2a406f1c
SHA1

e64b9f93f7cb89911260dae76ad80c915e588795
SHA256

541508503875a9aa694ed1a45045a545113f46163ba22ca70e45116cff2fac58
SHA512

2bf6ca712855300c646791468e4400ba58136f1c6dc6c6fead645de81b757c62c9cd76aa9e3de854678aee75427b6047bc72845fe788723989faebeb1f9fcd76
SSDEEP

1536:Gtbad8oQmjBhVNiHseMxkZS8/F3aaRutY3YdL9YW0oliVd:maSMBhVNgMISe6YIdLSWob

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2708	2232	rundll32.exe	30
PID 2232 wrote to memory of 2708	2232	rundll32.exe	30
PID 2232 wrote to memory of 2708	2232	rundll32.exe	30
PID 2232 wrote to memory of 2708	2232	rundll32.exe	30
PID 2232 wrote to memory of 2708	2232	rundll32.exe	30
PID 2232 wrote to memory of 2708	2232	rundll32.exe	30
PID 2232 wrote to memory of 2708	2232	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\281e68b84bd63930d6c4de7f2a406f1c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\281e68b84bd63930d6c4de7f2a406f1c_JaffaCakes118.dll,#1
  2⤵
  PID:2708