06b047a5927792fcf04b798400c5e0b9117534f4eed1499f77444a735c1ce349

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 13:28

Target

2281a4329d2a750eac82daa94d1cc10f_JaffaCakes118.dll
Size

97KB
MD5

2281a4329d2a750eac82daa94d1cc10f
SHA1

c06b4f9456b76bb9d3f08835c63743c456dce61a
SHA256

06b047a5927792fcf04b798400c5e0b9117534f4eed1499f77444a735c1ce349
SHA512

f34919b0f0ad3ea2d7a9395b65e2561bb36d14b06eb840e09c44a1b752b99c52a3193525ade56dccb8f84ad1681ac124636ca17c6572d90ccb7f6f9be831adcb
SSDEEP

1536:JA6stcQ6tj4s5B+Fc+rvlUyJkRhpUvpCAh+osaGFL5nDhFo0Cr0:JA6si1t6c6NUymXxo/GFL5nDhWm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1776	2224	rundll32.exe	28
PID 2224 wrote to memory of 1776	2224	rundll32.exe	28
PID 2224 wrote to memory of 1776	2224	rundll32.exe	28
PID 2224 wrote to memory of 1776	2224	rundll32.exe	28
PID 2224 wrote to memory of 1776	2224	rundll32.exe	28
PID 2224 wrote to memory of 1776	2224	rundll32.exe	28
PID 2224 wrote to memory of 1776	2224	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2281a4329d2a750eac82daa94d1cc10f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2281a4329d2a750eac82daa94d1cc10f_JaffaCakes118.dll,#1
  2⤵
  PID:1776