bb55aa6fb198d5979795d3fb45bc73a1e1cc6f1c56ad97c7337bcf0bd666b128

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 11:45

Target

9e10bb075bf715d7104a2f51ddfcf364_JaffaCakes118.dll
Size

206KB
MD5

9e10bb075bf715d7104a2f51ddfcf364
SHA1

f670594fc7ac9594a240dadd89d8bd836cb5045f
SHA256

bb55aa6fb198d5979795d3fb45bc73a1e1cc6f1c56ad97c7337bcf0bd666b128
SHA512

f9f8443255a56f014ce581f752767103e4d031a0f51661c37857d3eda140d523de7fb50b1f243c3c4c7630d94c8c65ddcbc056bfe29659ed4ce3e1e65e55d7f6
SSDEEP

3072:nrvYXMJJciFoSYMoXYQlwfv/gF8jua3PX4Ns5drwolUtwsVeL5KCuNS:EXkiq4wfv4Kjnv+srwoPAdS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2456 wrote to memory of 1624	2456	rundll32.exe	rundll32.exe
PID 2456 wrote to memory of 1624	2456	rundll32.exe	rundll32.exe
PID 2456 wrote to memory of 1624	2456	rundll32.exe	rundll32.exe
PID 2456 wrote to memory of 1624	2456	rundll32.exe	rundll32.exe
PID 2456 wrote to memory of 1624	2456	rundll32.exe	rundll32.exe
PID 2456 wrote to memory of 1624	2456	rundll32.exe	rundll32.exe
PID 2456 wrote to memory of 1624	2456	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e10bb075bf715d7104a2f51ddfcf364_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e10bb075bf715d7104a2f51ddfcf364_JaffaCakes118.dll,#1
2⤵
PID:1624