0c6eba4815b80e83f908208d80df0142e960d38904ef9cebe718d1c0bd89ccc6

Analysis

max time kernel
18s
max time network
19s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 12:02

Target

5bdaf23675c065e4bfed63fae0a01379_JaffaCakes118.dll
Size

137KB
MD5

5bdaf23675c065e4bfed63fae0a01379
SHA1

53d2997dc3359a78de761c748c4054b7f14ba015
SHA256

0c6eba4815b80e83f908208d80df0142e960d38904ef9cebe718d1c0bd89ccc6
SHA512

7b9b9b5c50dde6b92591f6d9df858af9a356c4a2fab4c1dd5dce4e07fadb96f045f7ec8b9d832d0b452f2639597a46c5688bf383f3b56dc121835e934daef8e1
SSDEEP

3072:8BhE7pCpDPT8iqc1OBWtaMm9i8WSeNm+U7lDhX9z:8BhMp8Dgiq5M2W74xhtz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2244	1896	rundll32.exe	29
PID 1896 wrote to memory of 2244	1896	rundll32.exe	29
PID 1896 wrote to memory of 2244	1896	rundll32.exe	29
PID 1896 wrote to memory of 2244	1896	rundll32.exe	29
PID 1896 wrote to memory of 2244	1896	rundll32.exe	29
PID 1896 wrote to memory of 2244	1896	rundll32.exe	29
PID 1896 wrote to memory of 2244	1896	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bdaf23675c065e4bfed63fae0a01379_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bdaf23675c065e4bfed63fae0a01379_JaffaCakes118.dll,#1
  2⤵
  PID:2244