ea71b52e071544c97b791cd9eee14ceee5a69edab78624c039d14d11d21d8aa7

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 17:01

Target

0ed9ba64e8b2ea3392f2619216cba148_JaffaCakes118.dll
Size

36KB
MD5

0ed9ba64e8b2ea3392f2619216cba148
SHA1

90737640c114ca11b4078397badc25d521467c92
SHA256

ea71b52e071544c97b791cd9eee14ceee5a69edab78624c039d14d11d21d8aa7
SHA512

a3caa8b15f29831aab2cac9a5cb83f91734a2c7f095a82c8b410850455c7535e65bcaa7f14f632221fc07f62f0973a6b071a09d445e46bd48b5e6d7a1f2224e5
SSDEEP

768:Gd53hJbyNbNON0lQwuXgcR1pV7Oq7Kj95hNDRR0VAZlVq:2xByNbN+eqgcRF7V7YvdR0VAzI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2548	3024	rundll32.exe	28
PID 3024 wrote to memory of 2548	3024	rundll32.exe	28
PID 3024 wrote to memory of 2548	3024	rundll32.exe	28
PID 3024 wrote to memory of 2548	3024	rundll32.exe	28
PID 3024 wrote to memory of 2548	3024	rundll32.exe	28
PID 3024 wrote to memory of 2548	3024	rundll32.exe	28
PID 3024 wrote to memory of 2548	3024	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ed9ba64e8b2ea3392f2619216cba148_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ed9ba64e8b2ea3392f2619216cba148_JaffaCakes118.dll,#1
  2⤵
  PID:2548