cd9ddef53c0df89735b30daf088ef75b9291332df5eb6fdddce8657cdc5e93d6

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 00:21

Target

05651921b136aad70e1a7a2fc4c4f633_JaffaCakes118.dll
Size

6KB
MD5

05651921b136aad70e1a7a2fc4c4f633
SHA1

4d5eb91a0d494c8898ecb2d6bbeb4b4945f2e02d
SHA256

cd9ddef53c0df89735b30daf088ef75b9291332df5eb6fdddce8657cdc5e93d6
SHA512

1fdfeca469908cba05b616c398edcb51dc76f00798d1e640713e1a57502a5e98554d0ba56bab66a8db495bdb43654fe8f8d5aef3e0b186d20964e952475466aa
SSDEEP

192:nLYB6y/Fk4pgAPzpVXAEA2uxllG0ObtI4:y6y/+4SqXAOuxijJI4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2380	2356	rundll32.exe	28
PID 2356 wrote to memory of 2380	2356	rundll32.exe	28
PID 2356 wrote to memory of 2380	2356	rundll32.exe	28
PID 2356 wrote to memory of 2380	2356	rundll32.exe	28
PID 2356 wrote to memory of 2380	2356	rundll32.exe	28
PID 2356 wrote to memory of 2380	2356	rundll32.exe	28
PID 2356 wrote to memory of 2380	2356	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05651921b136aad70e1a7a2fc4c4f633_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05651921b136aad70e1a7a2fc4c4f633_JaffaCakes118.dll,#1
  2⤵
  PID:2380