a8ac766a8e67f32b83d209b95f6c6892fe46beaed1924daee99ff47a5cd54746

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 14:32

Target

f5fd7de0d24a8cf175cd0c960ef43356_JaffaCakes118.dll
Size

280KB
MD5

f5fd7de0d24a8cf175cd0c960ef43356
SHA1

5e419c07195edaff366d128ebed34a8c2e575445
SHA256

a8ac766a8e67f32b83d209b95f6c6892fe46beaed1924daee99ff47a5cd54746
SHA512

d4fc1b4a75a240970f46e1a11a9f2f919cc0d11591960443e20abc9ff4bff83320ad8d686d7813915356a7f66b4192e579793cffe72e5a8a6ac3bb0bbdbb1a0d
SSDEEP

6144:ZTdkQhZh64qiFfsunLH9sex+hoYFSqMxtNX7g1WBbKQPg4OUaKa07RlfE3vPACAc:td7hZh64qiFfsunLH9sex+hoYFSqMxtw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2760	2292	rundll32.exe	28
PID 2292 wrote to memory of 2760	2292	rundll32.exe	28
PID 2292 wrote to memory of 2760	2292	rundll32.exe	28
PID 2292 wrote to memory of 2760	2292	rundll32.exe	28
PID 2292 wrote to memory of 2760	2292	rundll32.exe	28
PID 2292 wrote to memory of 2760	2292	rundll32.exe	28
PID 2292 wrote to memory of 2760	2292	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5fd7de0d24a8cf175cd0c960ef43356_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5fd7de0d24a8cf175cd0c960ef43356_JaffaCakes118.dll,#1
  2⤵
  PID:2760