de347ccd86991ed59a74460d047791a8d2fb2246931ee15d762e3a7898a9803e

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 01:51

Target

0be599284cfea94676414e7460938e80_JaffaCakes118.dll
Size

14KB
MD5

0be599284cfea94676414e7460938e80
SHA1

7aaa61a9d9df3556b8e1b6510bf554c3869800dd
SHA256

de347ccd86991ed59a74460d047791a8d2fb2246931ee15d762e3a7898a9803e
SHA512

35893eea4ebc02b3e6889461000e734801124649948d3f57788adb5df1e87264d324b6831cf787ca320039c7e611ca21fec6375c28e4f3e310a639e6c010f61f
SSDEEP

192:WDWEebrNen2UE72ghAFkXDZ5h3/vcNSDubcYjfnxdyy9pjk5QU3WotoMFAX9P:6WEa5e7ghHDZj3ncNOulLyy9pjk2D4+

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	2928	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2928	2968	rundll32.exe	28
PID 2968 wrote to memory of 2928	2968	rundll32.exe	28
PID 2968 wrote to memory of 2928	2968	rundll32.exe	28
PID 2968 wrote to memory of 2928	2968	rundll32.exe	28
PID 2968 wrote to memory of 2928	2968	rundll32.exe	28
PID 2968 wrote to memory of 2928	2968	rundll32.exe	28
PID 2968 wrote to memory of 2928	2968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0be599284cfea94676414e7460938e80_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0be599284cfea94676414e7460938e80_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2928