b6dbcb94c096f5c43df0c56dc53a9ead8b2de9fee53c0462fc475126998df6fc

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 15:49

Target

6f0993c9c8782ac0aebeda0398d4960a_JaffaCakes118.dll
Size

411KB
MD5

6f0993c9c8782ac0aebeda0398d4960a
SHA1

10172b2f51660c7ae44e7daf37d24703f09c7be9
SHA256

b6dbcb94c096f5c43df0c56dc53a9ead8b2de9fee53c0462fc475126998df6fc
SHA512

2c0f42440d30e1a5ed630029faa197ce1287ef65695f8d5edd93a1f81073620eea8b261dfed5563c94ef12c639d1747d8b1b0bea6e92eef374a537ca6e8a5109
SSDEEP

6144:/HC1rI3xRKo+6oQYrX+UAAvuOCDtfWsB4RCzEqjGWxo6Ah3Q:/HC16jRoQXUAAbCDtkRhh6Ah3Q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 640	1932	rundll32.exe	28
PID 1932 wrote to memory of 640	1932	rundll32.exe	28
PID 1932 wrote to memory of 640	1932	rundll32.exe	28
PID 1932 wrote to memory of 640	1932	rundll32.exe	28
PID 1932 wrote to memory of 640	1932	rundll32.exe	28
PID 1932 wrote to memory of 640	1932	rundll32.exe	28
PID 1932 wrote to memory of 640	1932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f0993c9c8782ac0aebeda0398d4960a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f0993c9c8782ac0aebeda0398d4960a_JaffaCakes118.dll,#1
  2⤵
  PID:640