a99e7533ebc9da1d6f17ad7d4225178f0ef502f1c46d603c2c8d593cf2889d55

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 06:11

Target

2b4379317a634bba7657252d8462595c_JaffaCakes118.dll
Size

43KB
MD5

2b4379317a634bba7657252d8462595c
SHA1

a5c6427cd53c516bbd3a6c2f6fdd42140fb97374
SHA256

a99e7533ebc9da1d6f17ad7d4225178f0ef502f1c46d603c2c8d593cf2889d55
SHA512

2366585ada65cd579a738188e7710d76047ae233f0499843eeb4a66782ba62be57db793fa01d88a098d96d9324e58a0765953c0289502fb5448faa646bcddf1a
SSDEEP

768:7zUZYX8QXsp6O3aJGqUSouLxp/sG2QsS17rLh87op4XM7PG2SQDoYK77C2AMf9LV:7EYMQXspKGqUSohBg1HV8y4yGA1K77C4

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2272	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2272	2268	rundll32.exe	28
PID 2268 wrote to memory of 2272	2268	rundll32.exe	28
PID 2268 wrote to memory of 2272	2268	rundll32.exe	28
PID 2268 wrote to memory of 2272	2268	rundll32.exe	28
PID 2268 wrote to memory of 2272	2268	rundll32.exe	28
PID 2268 wrote to memory of 2272	2268	rundll32.exe	28
PID 2268 wrote to memory of 2272	2268	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b4379317a634bba7657252d8462595c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b4379317a634bba7657252d8462595c_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2272