ba1f1242bcec38356b857d851c3fcdd6b4dd080c0a429b68dc8a92666011c658

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 06:30

Target

0d0b5ea93903922ccee8e37427c5e696_JaffaCakes118.dll
Size

106KB
MD5

0d0b5ea93903922ccee8e37427c5e696
SHA1

73f3f7a26e51b902b7772dc9f053254a99127682
SHA256

ba1f1242bcec38356b857d851c3fcdd6b4dd080c0a429b68dc8a92666011c658
SHA512

268883e5d7e01dae59fe4ffb5d99bdbe8b376ed4664318ccdf223ac0fd924a40993df0abc3216ead735066ee9d5f05ebf8023326b14832a9be70dca3776e23f0
SSDEEP

1536:4JcJFXMGPAvJUXcKNHfV/zzK9jY5W7bO2YorYYMlS64ciFEblcMoRwus3:xLckABU9F9KY5Z4CclRwuE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28
PID 2012 wrote to memory of 2092	2012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d0b5ea93903922ccee8e37427c5e696_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d0b5ea93903922ccee8e37427c5e696_JaffaCakes118.dll,#1
  2⤵
  PID:2092