7b34a7c350f7bdb1520b363aa9f93175733b03ad8054035142f2cd87438cef15

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 08:59

Target

12007f531c052a07638709864dc156f3_JaffaCakes118.dll
Size

768KB
MD5

12007f531c052a07638709864dc156f3
SHA1

3afc1d7dae97719fbb0b422b5562845b6cdfa55a
SHA256

7b34a7c350f7bdb1520b363aa9f93175733b03ad8054035142f2cd87438cef15
SHA512

5ee66fb1e730c2ba3b3cbac1f7e98611011b8e5f9cb5591f26ae0eede3ea8c09a1fd4fcbe901662229b4232c45afd737082c01f2c14842757136a1114178acdf
SSDEEP

12288:rayl/vnFzSigLDsBxXTWWbAu305YckJjKXtDyFAU7/0KSlqFLZew:ra4F2iMD+bbAf5HkJWXtO17/0NcFLZT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1992	1632	rundll32.exe	28
PID 1632 wrote to memory of 1992	1632	rundll32.exe	28
PID 1632 wrote to memory of 1992	1632	rundll32.exe	28
PID 1632 wrote to memory of 1992	1632	rundll32.exe	28
PID 1632 wrote to memory of 1992	1632	rundll32.exe	28
PID 1632 wrote to memory of 1992	1632	rundll32.exe	28
PID 1632 wrote to memory of 1992	1632	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12007f531c052a07638709864dc156f3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12007f531c052a07638709864dc156f3_JaffaCakes118.dll,#1
  2⤵
  PID:1992