4653ba6cbd5a01d01515d0f82c9c86903582cad6ac25d0f1074a489337bb7b5d

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 17:37

Target

0ef34baebf5cd5d146acb140de7ef12e_JaffaCakes118.dll
Size

65KB
MD5

0ef34baebf5cd5d146acb140de7ef12e
SHA1

db49c0765bc5faa41974897799ccd87206765e76
SHA256

4653ba6cbd5a01d01515d0f82c9c86903582cad6ac25d0f1074a489337bb7b5d
SHA512

cbfcc79c530c557843bd652bf9b533e222a63cb3967d29ec0e37963ed4e3a04d856856cdb975108dc54ff3f8505967a8db3da4ce2d911b768e3b2f056e5a58d2
SSDEEP

1536:yl3E0TpJt92YPo2T5gPPlr83KHI7LQ4TYocUV5ehKrSC:E39L2N2T5Kh83OI7M1ocXEWC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2976	2116	rundll32.exe	28
PID 2116 wrote to memory of 2976	2116	rundll32.exe	28
PID 2116 wrote to memory of 2976	2116	rundll32.exe	28
PID 2116 wrote to memory of 2976	2116	rundll32.exe	28
PID 2116 wrote to memory of 2976	2116	rundll32.exe	28
PID 2116 wrote to memory of 2976	2116	rundll32.exe	28
PID 2116 wrote to memory of 2976	2116	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ef34baebf5cd5d146acb140de7ef12e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ef34baebf5cd5d146acb140de7ef12e_JaffaCakes118.dll,#1
  2⤵
  PID:2976