6506252da196a261d54314eccd3cbbb6744706423eaf1655499e2911753834d8

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 18:06

Target

f65d633079ccfe2bb724f8f858de42f7_JaffaCakes118.dll
Size

32KB
MD5

f65d633079ccfe2bb724f8f858de42f7
SHA1

d438e2d551bb90e49ad85a662ad7c470a06b0bb8
SHA256

6506252da196a261d54314eccd3cbbb6744706423eaf1655499e2911753834d8
SHA512

69c0a8ab74cf80eba442bacf9db05591a87cbb9f8f72fc549a2ecaa54e8f6f8609d62f86716539736010f2c68aa43a091896a20f215e2b027ee7dc857f8ffabb
SSDEEP

768:RbQqCiZHgb+X6glv+CrCgmUSacGo3VBffd6722MDylb0OqOSBRBw:RbhCiZAW6glv+CrCgmUSacGo3VBfQ72u

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1744	2944	rundll32.exe	28
PID 2944 wrote to memory of 1744	2944	rundll32.exe	28
PID 2944 wrote to memory of 1744	2944	rundll32.exe	28
PID 2944 wrote to memory of 1744	2944	rundll32.exe	28
PID 2944 wrote to memory of 1744	2944	rundll32.exe	28
PID 2944 wrote to memory of 1744	2944	rundll32.exe	28
PID 2944 wrote to memory of 1744	2944	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f65d633079ccfe2bb724f8f858de42f7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f65d633079ccfe2bb724f8f858de42f7_JaffaCakes118.dll,#1
  2⤵
  PID:1744