01beb7aa4fd040130c6bbeb4f09d848c390a811a056a2855960a6c9e781af814

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 19:26

Target

f68013adfe203094178c76d4b58c5cc7_JaffaCakes118.dll
Size

7KB
MD5

f68013adfe203094178c76d4b58c5cc7
SHA1

348afb9d82f5d55a7f2a086103b95d3ab7bc941b
SHA256

01beb7aa4fd040130c6bbeb4f09d848c390a811a056a2855960a6c9e781af814
SHA512

01a0dd81e366fe95681598a567c82feca0e39e6c8f9d49ce4a0a3ba25879ec11387f71cce861b2171bc42b290d2f19636c01e0dce12b70fd1d715de57f05d9c1
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWSbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPkq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2192	2892	rundll32.exe	28
PID 2892 wrote to memory of 2192	2892	rundll32.exe	28
PID 2892 wrote to memory of 2192	2892	rundll32.exe	28
PID 2892 wrote to memory of 2192	2892	rundll32.exe	28
PID 2892 wrote to memory of 2192	2892	rundll32.exe	28
PID 2892 wrote to memory of 2192	2892	rundll32.exe	28
PID 2892 wrote to memory of 2192	2892	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f68013adfe203094178c76d4b58c5cc7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f68013adfe203094178c76d4b58c5cc7_JaffaCakes118.dll,#1
  2⤵
  PID:2192