11ca228dc681ac9218a70a1934835f19c10d48226ac67e7ae88f7c435c8533d0

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 12:12

Target

052a201bc961a4bdbdd9b24ba894bec0_JaffaCakes118.dll
Size

3.0MB
MD5

052a201bc961a4bdbdd9b24ba894bec0
SHA1

4b881e5c36662fa4b4dd38e7339b8cf662356546
SHA256

11ca228dc681ac9218a70a1934835f19c10d48226ac67e7ae88f7c435c8533d0
SHA512

8626fce645ed4f1de566968b89352348ba74099e25601add60a17aa27a84e7274c8b4eb5175f3f9c2702c34417a39c25cf366e601bb782772f4e05127bc80c29
SSDEEP

49152:gbcr6levCyhCTCjyLBxMdF3V50T6mMGFuImn50VENZ4Y7TUxIj:acr6gvCyxyL+YuB50VENZhv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 2216	952	rundll32.exe	28
PID 952 wrote to memory of 2216	952	rundll32.exe	28
PID 952 wrote to memory of 2216	952	rundll32.exe	28
PID 952 wrote to memory of 2216	952	rundll32.exe	28
PID 952 wrote to memory of 2216	952	rundll32.exe	28
PID 952 wrote to memory of 2216	952	rundll32.exe	28
PID 952 wrote to memory of 2216	952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\052a201bc961a4bdbdd9b24ba894bec0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\052a201bc961a4bdbdd9b24ba894bec0_JaffaCakes118.dll,#1
  2⤵
  PID:2216