1fd6c1118782d0f2666bec2c12c702b93564e06a39cbf833debae7d6b6cf2e8a

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 17:35

Target

84ec7a48992273c77b0df743a1754706_JaffaCakes118.dll
Size

74KB
MD5

84ec7a48992273c77b0df743a1754706
SHA1

965be9c463ca92da852a811dd929a01dd89f0891
SHA256

1fd6c1118782d0f2666bec2c12c702b93564e06a39cbf833debae7d6b6cf2e8a
SHA512

e732e707b2cdeb8a2190e146f187c752358b6f489846bbe183c596b5b00384f604e5920df0283e109fadbfd6c35d0d2b456324815fa2ca14f550ae38f98d293c
SSDEEP

1536:B/7tY+plsUPpUb+ZLj5sDDqGMR9IzEqgNXJ8CzomJzl+nWfrdIAwixajFZo+dXUY:BDW+plsUwoLj2DDi927gHbBlFdfwi4JJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\84ec7a48992273c77b0df743a1754706_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\84ec7a48992273c77b0df743a1754706_JaffaCakes118.dll,#1
  2⤵
  PID:2196