ca1c04403fac4f1416f2ad34cb653e88adf59ca3847e58f5f5c1d5e64f5cb084

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 18:21

Target

81727a02f55357248e848dcbfeba5b3c_JaffaCakes118.dll
Size

60KB
MD5

81727a02f55357248e848dcbfeba5b3c
SHA1

31606a3c4bf016815998904eac2aacceded813d7
SHA256

ca1c04403fac4f1416f2ad34cb653e88adf59ca3847e58f5f5c1d5e64f5cb084
SHA512

95203273ee0df390cf94a0a9d7fcafc84f202fa3908076387dbeaeb76f75c7ca36518a5063caf5b3398df235a7dc88971d553543433bc0f25b400a415bf747bd
SSDEEP

1536:WrRQtfuQCsB9wSuiRhtmgxojowvWVPE0eJog620aQF:ykm+GdiRhtmToD26FaE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1984	2192	rundll32.exe	29
PID 2192 wrote to memory of 1984	2192	rundll32.exe	29
PID 2192 wrote to memory of 1984	2192	rundll32.exe	29
PID 2192 wrote to memory of 1984	2192	rundll32.exe	29
PID 2192 wrote to memory of 1984	2192	rundll32.exe	29
PID 2192 wrote to memory of 1984	2192	rundll32.exe	29
PID 2192 wrote to memory of 1984	2192	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\81727a02f55357248e848dcbfeba5b3c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\81727a02f55357248e848dcbfeba5b3c_JaffaCakes118.dll,#1
  2⤵
  PID:1984