a90b46323f3d1b4d0359512e3121f113b43af2988f8d4853d0b0eb253e82ac7c

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 11:35

Target

1b24289e3e96b7e1e1f18f25663e52d0_JaffaCakes118.dll
Size

56KB
MD5

1b24289e3e96b7e1e1f18f25663e52d0
SHA1

a6ce26c76a5ffd3be7cd210fcd82e8273a50ca63
SHA256

a90b46323f3d1b4d0359512e3121f113b43af2988f8d4853d0b0eb253e82ac7c
SHA512

eaba7ed064d6016a955d464fa552a2712e8f439f6f701ad5e76c04a470ce8109456a6e9674869ab48df973bc4f4a6d780a432aac4cdef6b00051a100d03492b6
SSDEEP

1536:2jPk6njHzQyuVHENBnZzjeD0Kz3KWV/jNguj/I:2jPk6njHduVk93va7fT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 1676	756	rundll32.exe	28
PID 756 wrote to memory of 1676	756	rundll32.exe	28
PID 756 wrote to memory of 1676	756	rundll32.exe	28
PID 756 wrote to memory of 1676	756	rundll32.exe	28
PID 756 wrote to memory of 1676	756	rundll32.exe	28
PID 756 wrote to memory of 1676	756	rundll32.exe	28
PID 756 wrote to memory of 1676	756	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b24289e3e96b7e1e1f18f25663e52d0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b24289e3e96b7e1e1f18f25663e52d0_JaffaCakes118.dll,#1
  2⤵
  PID:1676