a51334365e45ac5269ed16d1c9604199c507c748e8ec297617a302f561d735f5

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 03:41

Target

148dfd1365b52acb2276ce5cb1d2b122_JaffaCakes118.dll
Size

32KB
MD5

148dfd1365b52acb2276ce5cb1d2b122
SHA1

a09d7f5629f2025c277d13a17e198d9bf1455911
SHA256

a51334365e45ac5269ed16d1c9604199c507c748e8ec297617a302f561d735f5
SHA512

1f9e3e1a71af643a32f11daf860a1b966c00c3aa09b87a8f52b98e355bc571166bb6999b41a1484c57dca502bcb5e929d6a3ac6ee6acf9ba01e332386015a667
SSDEEP

768:a1QWtHd8PZIaaN5kD75KINzhqDmRCkIXL:a1dHoIaaG7559kqRCzb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2600	2860	rundll32.exe	28
PID 2860 wrote to memory of 2600	2860	rundll32.exe	28
PID 2860 wrote to memory of 2600	2860	rundll32.exe	28
PID 2860 wrote to memory of 2600	2860	rundll32.exe	28
PID 2860 wrote to memory of 2600	2860	rundll32.exe	28
PID 2860 wrote to memory of 2600	2860	rundll32.exe	28
PID 2860 wrote to memory of 2600	2860	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\148dfd1365b52acb2276ce5cb1d2b122_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\148dfd1365b52acb2276ce5cb1d2b122_JaffaCakes118.dll,#1
  2⤵
  PID:2600