6989f7671aaa3bf1691a63bacac093a00eb3c41adf56def3c69c98ad6a3a8aaf

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 10:21

Target

8a2a9920078d528e90c362ebbcd0eb60_JaffaCakes118.dll
Size

82KB
MD5

8a2a9920078d528e90c362ebbcd0eb60
SHA1

0a731cd20fa24e8ff2f2a3c9d9403f6cfa87c812
SHA256

6989f7671aaa3bf1691a63bacac093a00eb3c41adf56def3c69c98ad6a3a8aaf
SHA512

ea1cfe37494a9ab49d70f850d7e20c317b8c2d3d15b4cfca66d4a90d9efea2ead6e2c21b466df0b9abb1453ca5912a8ad86c8930fc834d0b69369aad502b139f
SSDEEP

1536:E0nndMFs7mV/+aISw55WM5y8gmUgpgq6HICS4Ayvh4NKmL/u9IFlOQQbFtfBI:TMSEVIx2V83UcZwvh4NKE//lRQbFtfBI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2560	2136	rundll32.exe	28
PID 2136 wrote to memory of 2560	2136	rundll32.exe	28
PID 2136 wrote to memory of 2560	2136	rundll32.exe	28
PID 2136 wrote to memory of 2560	2136	rundll32.exe	28
PID 2136 wrote to memory of 2560	2136	rundll32.exe	28
PID 2136 wrote to memory of 2560	2136	rundll32.exe	28
PID 2136 wrote to memory of 2560	2136	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a2a9920078d528e90c362ebbcd0eb60_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a2a9920078d528e90c362ebbcd0eb60_JaffaCakes118.dll,#1
  2⤵
  PID:2560