ab1db2c6edbb03b9f3033f2b712a3f302276bf0fa862bc5faade298febed779b

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 07:07

Target

15184a929ad2c97ff1ff471c59f00a19_JaffaCakes118.dll
Size

116KB
MD5

15184a929ad2c97ff1ff471c59f00a19
SHA1

49c9b7c92f3bf2223829caa8f511f58ff6bd4c7b
SHA256

ab1db2c6edbb03b9f3033f2b712a3f302276bf0fa862bc5faade298febed779b
SHA512

22785cfb1fe873757caa3bb21ba9bf92ea9d6d4380da679dc5ad956507acf6db96612661f2d382c30ede058439523b618720e0a52ea5dddf13b0be0f29fa488b
SSDEEP

1536:rD44bNwF+F3pzO+jd9XkvT4BvdEST/8F+J7xKqUOSFkyuzAtZ4tXcDzMw:HjtpzpjY4BFEStUXFpuzAtZ4tXcDzM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1576	2196	rundll32.exe	28
PID 2196 wrote to memory of 1576	2196	rundll32.exe	28
PID 2196 wrote to memory of 1576	2196	rundll32.exe	28
PID 2196 wrote to memory of 1576	2196	rundll32.exe	28
PID 2196 wrote to memory of 1576	2196	rundll32.exe	28
PID 2196 wrote to memory of 1576	2196	rundll32.exe	28
PID 2196 wrote to memory of 1576	2196	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15184a929ad2c97ff1ff471c59f00a19_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\15184a929ad2c97ff1ff471c59f00a19_JaffaCakes118.dll,#1
  2⤵
  PID:1576