29d11d8edc037f1856282e25f5b793ae6b0a6fb929479dcbab646b6f998faf25

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 15:07

Target

1674fa59d8cac282eadb7fab0122825b_JaffaCakes118.dll
Size

482KB
MD5

1674fa59d8cac282eadb7fab0122825b
SHA1

945adbf8f24d64d6469d899ecaf39e33382d389a
SHA256

29d11d8edc037f1856282e25f5b793ae6b0a6fb929479dcbab646b6f998faf25
SHA512

435685c6a22bb3a5c5ffc1bf697dc28a47a9a575fc0d50e504945262f367d9339dbd747e4ee16aef9e6deb94ae8123dffe9ad3ca18ff8484b71ac0e6a0d5ffcd
SSDEEP

12288:iFFT2dXQrp7cixxekGw22b7fT9x10WGyfx:iKOVci5GY7fb1fGyf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2356	2172	rundll32.exe	28
PID 2172 wrote to memory of 2356	2172	rundll32.exe	28
PID 2172 wrote to memory of 2356	2172	rundll32.exe	28
PID 2172 wrote to memory of 2356	2172	rundll32.exe	28
PID 2172 wrote to memory of 2356	2172	rundll32.exe	28
PID 2172 wrote to memory of 2356	2172	rundll32.exe	28
PID 2172 wrote to memory of 2356	2172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1674fa59d8cac282eadb7fab0122825b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1674fa59d8cac282eadb7fab0122825b_JaffaCakes118.dll,#1
  2⤵
  PID:2356