10aad4d7f0716945f033007d08afd394daf26988878fb31191c42f7198f21002

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 06:57

Target

78452c8fc8fedb8553810a96460ee632_JaffaCakes118.dll
Size

1.1MB
MD5

78452c8fc8fedb8553810a96460ee632
SHA1

8d71cc962d273fb697b7ac1a1d8b81515aa6d857
SHA256

10aad4d7f0716945f033007d08afd394daf26988878fb31191c42f7198f21002
SHA512

12d521d6ca234314079a9028b66ee4d18ef00def4fe80c791f0691d81a75fab88916b7f3ba826d05e6732318002a3cd8fb10f2e4f33b564aac5cafcc00f3664d
SSDEEP

24576:zU1h2CHyh8PYjLUv1KZVX6hKmmgf39v06hpTzXAfr:q8VKK2/p0OpTzXAD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1868 wrote to memory of 1952	1868	rundll32.exe	rundll32.exe
PID 1868 wrote to memory of 1952	1868	rundll32.exe	rundll32.exe
PID 1868 wrote to memory of 1952	1868	rundll32.exe	rundll32.exe
PID 1868 wrote to memory of 1952	1868	rundll32.exe	rundll32.exe
PID 1868 wrote to memory of 1952	1868	rundll32.exe	rundll32.exe
PID 1868 wrote to memory of 1952	1868	rundll32.exe	rundll32.exe
PID 1868 wrote to memory of 1952	1868	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78452c8fc8fedb8553810a96460ee632_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\78452c8fc8fedb8553810a96460ee632_JaffaCakes118.dll,#1
  2⤵
  PID:1952