9470033e9f93006b2a2d211e959e14bbf1178e2f4e237f0f18b880247b6bd49f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
23/06/2024, 23:42

Target

047cc896682a6140597c233c4b28a118_JaffaCakes118.dll
Size

32KB
MD5

047cc896682a6140597c233c4b28a118
SHA1

a136e9974595fd2ddfc953a04b5bb3a9bf78d880
SHA256

9470033e9f93006b2a2d211e959e14bbf1178e2f4e237f0f18b880247b6bd49f
SHA512

50b916cfad8637d08871fc346758c4eca955167bb4cd5800b016dffb75c3b6f1b5023ec772fcb631be888b1dad91b12a0fd8dc9a1a02172d46816e63b53df43a
SSDEEP

384:HQ8ltxq9gmZRfT8XDdwwTxhNJZgCVdGmXvXzzfA6z8f63NydLPx9AOgS4nUMBe8Q:llCgqfTshNffmmXPzzoI3NBa4fc8kxF9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2236	2088	rundll32.exe	28
PID 2088 wrote to memory of 2236	2088	rundll32.exe	28
PID 2088 wrote to memory of 2236	2088	rundll32.exe	28
PID 2088 wrote to memory of 2236	2088	rundll32.exe	28
PID 2088 wrote to memory of 2236	2088	rundll32.exe	28
PID 2088 wrote to memory of 2236	2088	rundll32.exe	28
PID 2088 wrote to memory of 2236	2088	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\047cc896682a6140597c233c4b28a118_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\047cc896682a6140597c233c4b28a118_JaffaCakes118.dll,#1
  2⤵
  PID:2236