2e16c45a817f4e762b629fff81d3ef74fb7a997de2169d445a4da38a3915843d

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 17:45

Target

09eda3f87187b7aad2f924e98321f47d_JaffaCakes118.dll
Size

10KB
MD5

09eda3f87187b7aad2f924e98321f47d
SHA1

0e7845301d584c2feddf4bb2290574af7475d1a9
SHA256

2e16c45a817f4e762b629fff81d3ef74fb7a997de2169d445a4da38a3915843d
SHA512

c2e8ae85e02d76e14440412036b1b7a8ceee59d52c1a16329834be68a6b1f3d3c5a88bee1570c616f8c7f90e72c8c57de20aa98a45b254daa31c058a60f33dcb
SSDEEP

192:41mjfw8dHabRDEgzHyl0NSyFWakiP84dW3qWak8Q7dW3o92b:48jhdHad/z20IyFWakC84dWaWak8cdWj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2092	3008	rundll32.exe	28
PID 3008 wrote to memory of 2092	3008	rundll32.exe	28
PID 3008 wrote to memory of 2092	3008	rundll32.exe	28
PID 3008 wrote to memory of 2092	3008	rundll32.exe	28
PID 3008 wrote to memory of 2092	3008	rundll32.exe	28
PID 3008 wrote to memory of 2092	3008	rundll32.exe	28
PID 3008 wrote to memory of 2092	3008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09eda3f87187b7aad2f924e98321f47d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09eda3f87187b7aad2f924e98321f47d_JaffaCakes118.dll,#1
  2⤵
  PID:2092