42e6fff593020220c24be9faef142eae150656effd2bde52fd10ae145bd607aa

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 08:55

Target

01b0bc949dc518cfd31dfa2de21298b1_JaffaCakes118.dll
Size

774KB
MD5

01b0bc949dc518cfd31dfa2de21298b1
SHA1

2752debf0428dbd9763f7c25d820c734b61c93ce
SHA256

42e6fff593020220c24be9faef142eae150656effd2bde52fd10ae145bd607aa
SHA512

5b204f67c7bff1574e4602eb4202a652a95d88fa1cde780ba01e95274bdd221786d754b4f05b6a783303eba60ee1cd82a8d05eb16f099526709dc740d5baddd8
SSDEEP

6144:7KzXU11R1+hzV5rZtZC50KzXU11R1+hzV5g5rZtZC50KzXU11R1+hzV5rZC5g5re:OXUPiTEXUPpTEXUPiZTEXUP4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01b0bc949dc518cfd31dfa2de21298b1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01b0bc949dc518cfd31dfa2de21298b1_JaffaCakes118.dll,#1
  2⤵
  PID:2488