24ba682e52ca2fb2505c96bdd6fa2e43e18c699c03fe29b227d59e18922e23bc

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 02:15

Target

f4d1ba2c5ff8c6c2310001735cd99d65_JaffaCakes118.dll
Size

526KB
MD5

f4d1ba2c5ff8c6c2310001735cd99d65
SHA1

cdccd6fde902461e4a5118aaf090631d7033ab00
SHA256

24ba682e52ca2fb2505c96bdd6fa2e43e18c699c03fe29b227d59e18922e23bc
SHA512

7b8d190f0867ea5e450bc93460bf881f655ef11c8f7f7bdf04defbd00ae11a6465cb5c8ccd3ac203a9adb2825da2a119f259fb20a4ec5c9e2990de366f20ae20
SSDEEP

12288:Mumm1faJUBlj8qzr9Hbpvp6dK9ioWVeEocRicPH:dmFm4OrJbpBcKjWVeERRiA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2056	2004	rundll32.exe	28
PID 2004 wrote to memory of 2056	2004	rundll32.exe	28
PID 2004 wrote to memory of 2056	2004	rundll32.exe	28
PID 2004 wrote to memory of 2056	2004	rundll32.exe	28
PID 2004 wrote to memory of 2056	2004	rundll32.exe	28
PID 2004 wrote to memory of 2056	2004	rundll32.exe	28
PID 2004 wrote to memory of 2056	2004	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4d1ba2c5ff8c6c2310001735cd99d65_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4d1ba2c5ff8c6c2310001735cd99d65_JaffaCakes118.dll,#1
  2⤵
  PID:2056