d14ba20449abf622a9c25527db9f81fa6acdd0ccad1512c001e7b8178fd81f53

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 10:47

Target

2844a0f1b74f0c4bcb23f30fa4dcdec9_JaffaCakes118.dll
Size

36KB
MD5

2844a0f1b74f0c4bcb23f30fa4dcdec9
SHA1

bc84b5e7d33853ecaaa17b23fe7a6da3da4cd742
SHA256

d14ba20449abf622a9c25527db9f81fa6acdd0ccad1512c001e7b8178fd81f53
SHA512

843c33dd3d0597fd6af9d55ad67f59e150dcc89b4b5c1bee33ad85fb60fd55cb1e6cd41bce34d6772de6da08e51e251a252b72230f495043dd1a5d3c1eed5671
SSDEEP

768:dT1BNCkK5gVGxlaZql9J1oT1cIg7/fO3+a5hCDKR4plx8Mf9O:9nNCl5X/J12y5736+4QWR4pz9E

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1628	2084	rundll32.exe	30
PID 2084 wrote to memory of 1628	2084	rundll32.exe	30
PID 2084 wrote to memory of 1628	2084	rundll32.exe	30
PID 2084 wrote to memory of 1628	2084	rundll32.exe	30
PID 2084 wrote to memory of 1628	2084	rundll32.exe	30
PID 2084 wrote to memory of 1628	2084	rundll32.exe	30
PID 2084 wrote to memory of 1628	2084	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2844a0f1b74f0c4bcb23f30fa4dcdec9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2844a0f1b74f0c4bcb23f30fa4dcdec9_JaffaCakes118.dll,#1
  2⤵
  PID:1628