089edcdfd1718e82d742ab60bbc115bc7f61c450cfb74c049d803732a8adc146

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 22:30

Target

23aabae74fa4d7c497670b1e0c56edeb_JaffaCakes118.dll
Size

51KB
MD5

23aabae74fa4d7c497670b1e0c56edeb
SHA1

fa7f1ca18b89b46bf3676ff084b65667005a059b
SHA256

089edcdfd1718e82d742ab60bbc115bc7f61c450cfb74c049d803732a8adc146
SHA512

63a3ca1d7cb488b2e70bf77fdd3eee01779e18ba48bb5977c38d373022465ecfa5ea629f0e0b50ec48763f872f33e7804624657b90d50626869e68033f01b169
SSDEEP

768:klQ+Mv3wflXkhMmdT4iscZtg6rBxIqWZ4dfQCjfelE5thU:kq+fNXIx41c3pxddylE5s

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 992	2100	rundll32.exe	28
PID 2100 wrote to memory of 992	2100	rundll32.exe	28
PID 2100 wrote to memory of 992	2100	rundll32.exe	28
PID 2100 wrote to memory of 992	2100	rundll32.exe	28
PID 2100 wrote to memory of 992	2100	rundll32.exe	28
PID 2100 wrote to memory of 992	2100	rundll32.exe	28
PID 2100 wrote to memory of 992	2100	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23aabae74fa4d7c497670b1e0c56edeb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23aabae74fa4d7c497670b1e0c56edeb_JaffaCakes118.dll,#1
  2⤵
  PID:992