02abd430c466b39065653b2bace7dfe941f9f2053762fe8a6f674b83e7c0f03c

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 12:31

Target

0602a82b423bcdeec89ca103c6681fa6_JaffaCakes118.dll
Size

72KB
MD5

0602a82b423bcdeec89ca103c6681fa6
SHA1

39c7dc83f671843d30efa746212d3ceb9be13c0d
SHA256

02abd430c466b39065653b2bace7dfe941f9f2053762fe8a6f674b83e7c0f03c
SHA512

ec7ff61f7df704c46a3f48e8ce81fa9adc852f365e4c054843adda067105f42537ca53d890bc87ae34e624876abd616c596e52794934165b9440dfd8c4c928e3
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 884	2420	rundll32.exe	28
PID 2420 wrote to memory of 884	2420	rundll32.exe	28
PID 2420 wrote to memory of 884	2420	rundll32.exe	28
PID 2420 wrote to memory of 884	2420	rundll32.exe	28
PID 2420 wrote to memory of 884	2420	rundll32.exe	28
PID 2420 wrote to memory of 884	2420	rundll32.exe	28
PID 2420 wrote to memory of 884	2420	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0602a82b423bcdeec89ca103c6681fa6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0602a82b423bcdeec89ca103c6681fa6_JaffaCakes118.dll,#1
  2⤵
  PID:884