d6075fcbebc1be86a7eef108372394ed6fe3bc6c3d7d711d61f839b074aa55b6

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 19:23

Target

0a64700fffb73c78e53aef5d59fb1bcb_JaffaCakes118.dll
Size

110KB
MD5

0a64700fffb73c78e53aef5d59fb1bcb
SHA1

07bb77efe635f17d1ee094143a40476e9174397d
SHA256

d6075fcbebc1be86a7eef108372394ed6fe3bc6c3d7d711d61f839b074aa55b6
SHA512

5e35f93dc896f4185e1ced3101cf4622a670e367fa658bb632bfe1a5808d5353b492dd53e824e528a38fb7471b1f44e17ace5eb9a00275df428e97c9e401fa3b
SSDEEP

3072:cmwEHYkE0EHTw6HP2qinb/0lQSL+cdstVwu9+WgFT9:xHY9UYbcE+cdstVwu5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2128	2764	rundll32.exe	28
PID 2764 wrote to memory of 2128	2764	rundll32.exe	28
PID 2764 wrote to memory of 2128	2764	rundll32.exe	28
PID 2764 wrote to memory of 2128	2764	rundll32.exe	28
PID 2764 wrote to memory of 2128	2764	rundll32.exe	28
PID 2764 wrote to memory of 2128	2764	rundll32.exe	28
PID 2764 wrote to memory of 2128	2764	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a64700fffb73c78e53aef5d59fb1bcb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a64700fffb73c78e53aef5d59fb1bcb_JaffaCakes118.dll,#1
  2⤵
  PID:2128

memory/2128-0-0x00000000006E0000-0x0000000000701000-memory.dmp

Filesize
132KB

Download