22fdbd270ee0f8cc94e39b57277ede84a34a451ec2c0dd0f1e4158d8338f73c6

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 15:00

Target

8ad382116b9acc3c37e02ed01cc0e2f4_JaffaCakes118.dll
Size

1.1MB
MD5

8ad382116b9acc3c37e02ed01cc0e2f4
SHA1

7fcaab765fc73c11e451aae1dc31fe6c179d9067
SHA256

22fdbd270ee0f8cc94e39b57277ede84a34a451ec2c0dd0f1e4158d8338f73c6
SHA512

5bee70d6fbc04513bca06734208261410171c0a349171278bf9c0f166bc16c34aebfa860e2a57fec00b0b9a4c2f4b3fee98ee62574a8e2435f5efc3250396d77
SSDEEP

24576:W9hxIYrQZxvEhyWh7x84Q0Q2Pu+pS0+M3tb0pvaep5Zfvd:ox7+Ehyc71Q0u/0J3tCieDVd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1412	2292	rundll32.exe	28
PID 2292 wrote to memory of 1412	2292	rundll32.exe	28
PID 2292 wrote to memory of 1412	2292	rundll32.exe	28
PID 2292 wrote to memory of 1412	2292	rundll32.exe	28
PID 2292 wrote to memory of 1412	2292	rundll32.exe	28
PID 2292 wrote to memory of 1412	2292	rundll32.exe	28
PID 2292 wrote to memory of 1412	2292	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ad382116b9acc3c37e02ed01cc0e2f4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ad382116b9acc3c37e02ed01cc0e2f4_JaffaCakes118.dll,#1
  2⤵
  PID:1412