9dcd7b7c340b7bb263696cac6c6753a67bd0b47e78d78c0ff83b58de1b4a2ac1

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 12:41

Target

06112539dbde3e5a6db89693653dd8bb_JaffaCakes118.dll
Size

33KB
MD5

06112539dbde3e5a6db89693653dd8bb
SHA1

56e3868cafd5dad3e34e4f4ddca1d20e8c4d382c
SHA256

9dcd7b7c340b7bb263696cac6c6753a67bd0b47e78d78c0ff83b58de1b4a2ac1
SHA512

be2402791b0d0e12037d9bcceb609140b203f1effb8e837910fb02b6adc3f3812d1e85535f04adeaad450a7427f4ee5efba790754540c437b7bd611c3f9aace8
SSDEEP

384:rbm2H7KLvJHFdd9ucDSkz/9SrOhMpPHZFVuq5XQWX401Cl4NrDMnuICyRdeks:fhbkJ/d9usSW/9OSKPpPXQSU2DMnp3do

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2692	2080	rundll32.exe	28
PID 2080 wrote to memory of 2692	2080	rundll32.exe	28
PID 2080 wrote to memory of 2692	2080	rundll32.exe	28
PID 2080 wrote to memory of 2692	2080	rundll32.exe	28
PID 2080 wrote to memory of 2692	2080	rundll32.exe	28
PID 2080 wrote to memory of 2692	2080	rundll32.exe	28
PID 2080 wrote to memory of 2692	2080	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06112539dbde3e5a6db89693653dd8bb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06112539dbde3e5a6db89693653dd8bb_JaffaCakes118.dll,#1
  2⤵
  PID:2692