2379372b2bba3e17bbaa959b1c239d09f7d02c3b8b56e4fbd14676d88e6d18c9

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-05-2024 19:16

Target

1dfa61fbe9359427da31f18d9d32c92f_JaffaCakes118.dll
Size

1.0MB
MD5

1dfa61fbe9359427da31f18d9d32c92f
SHA1

90f6f569178fd79e6a88fbdc087690801c943fa7
SHA256

2379372b2bba3e17bbaa959b1c239d09f7d02c3b8b56e4fbd14676d88e6d18c9
SHA512

d44b14e4389fa3d3de893376832273180968fd76fbfd143fd93fa079bac8e9b96b4e24281629754408ded26b4b5a1538a42aa09ee525932f1d2166afa8af29c9
SSDEEP

24576:sB/8n6keaVrgsD4WLXUklVlJkHSK7d2iK:oM5Vrgk70/7d2iK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2892 wrote to memory of 2972	2892	rundll32.exe	rundll32.exe
PID 2892 wrote to memory of 2972	2892	rundll32.exe	rundll32.exe
PID 2892 wrote to memory of 2972	2892	rundll32.exe	rundll32.exe
PID 2892 wrote to memory of 2972	2892	rundll32.exe	rundll32.exe
PID 2892 wrote to memory of 2972	2892	rundll32.exe	rundll32.exe
PID 2892 wrote to memory of 2972	2892	rundll32.exe	rundll32.exe
PID 2892 wrote to memory of 2972	2892	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dfa61fbe9359427da31f18d9d32c92f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2892

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dfa61fbe9359427da31f18d9d32c92f_JaffaCakes118.dll,#1
2⤵
PID:2972