7a46eb67edf2e7ff7f54335f52300c02cf730fdb8dabcc7b071f06ea5b3464fc

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 10:39

Target

0538ea9707972df05dd584777f8e5a74_JaffaCakes118.dll
Size

24KB
MD5

0538ea9707972df05dd584777f8e5a74
SHA1

5bfc27c87b685a5702e0b7f8cc21c487c3216507
SHA256

7a46eb67edf2e7ff7f54335f52300c02cf730fdb8dabcc7b071f06ea5b3464fc
SHA512

fd3c75533a0f0c3c0cd7e98ea39ca23c0e2bbec4abe7886a1f4d79d0c9a0dc1c27364eac816e68d1a45001b1eaa40e157b373a0207c7af6e40a41fc1f6af0202
SSDEEP

192:chsNGS9RWanc9Lht82SrBOUzk9m4VM8GjFVemPej8V1TqMXkM8A:scG8W59LhtEQA/4O82FV9PS8VkwkMp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2392	1368	rundll32.exe	28
PID 1368 wrote to memory of 2392	1368	rundll32.exe	28
PID 1368 wrote to memory of 2392	1368	rundll32.exe	28
PID 1368 wrote to memory of 2392	1368	rundll32.exe	28
PID 1368 wrote to memory of 2392	1368	rundll32.exe	28
PID 1368 wrote to memory of 2392	1368	rundll32.exe	28
PID 1368 wrote to memory of 2392	1368	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0538ea9707972df05dd584777f8e5a74_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0538ea9707972df05dd584777f8e5a74_JaffaCakes118.dll,#1
  2⤵
  PID:2392