d6f1b299c18e67bafdc9d71baa4f53c4d52c0074ab0dbcaa005ab0cc2dbd2382

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 13:04

Target

161b1502987364d3d4a0e85202056342_JaffaCakes118.dll
Size

56KB
MD5

161b1502987364d3d4a0e85202056342
SHA1

64ef86122205aa3a95882e8e3f93d08c39c55abd
SHA256

d6f1b299c18e67bafdc9d71baa4f53c4d52c0074ab0dbcaa005ab0cc2dbd2382
SHA512

823ecd3c2fc73f4964a180ed3a654349bedca92b4a9a036b792ded7ced8e8230cbac3f6d93d5f99eabf8b8c6eb51bcd0925839d646153c2562b1130fb1af1782
SSDEEP

1536:l+ItgAg0Y+WiABVQohIpNhqCdP84iODD7a8CTb:reAm+WiABeohIpNnva8CTb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\161b1502987364d3d4a0e85202056342_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\161b1502987364d3d4a0e85202056342_JaffaCakes118.dll,#1
  2⤵
  PID:1592