1dfc816ac291af0ab573971bf62e15e45eff3387be7fc80809263b9bbd380ee8

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 05:43

Target

276fc014780c04acf4fbebca37bd8cfa_JaffaCakes118.dll
Size

187KB
MD5

276fc014780c04acf4fbebca37bd8cfa
SHA1

5c7f27b7528eef5fa794db985c9cb7a453f4374d
SHA256

1dfc816ac291af0ab573971bf62e15e45eff3387be7fc80809263b9bbd380ee8
SHA512

33888aac8708c3c76fd7e026d5ee2eaeab5f77beaa77e244752fb4f107ed6fba4bdb44c1a3740533dd2f572e3d6bf95ed9778caa730e8c35c9dec1085e87ea74
SSDEEP

3072:TNAC5oFNXHjvEVJEwjKL95WPPIHBl+Jn4Y/T5GpBUshCcQ8sg:TWB8PQHKJnFTV8T

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2184	2192	rundll32.exe	29
PID 2192 wrote to memory of 2184	2192	rundll32.exe	29
PID 2192 wrote to memory of 2184	2192	rundll32.exe	29
PID 2192 wrote to memory of 2184	2192	rundll32.exe	29
PID 2192 wrote to memory of 2184	2192	rundll32.exe	29
PID 2192 wrote to memory of 2184	2192	rundll32.exe	29
PID 2192 wrote to memory of 2184	2192	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\276fc014780c04acf4fbebca37bd8cfa_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\276fc014780c04acf4fbebca37bd8cfa_JaffaCakes118.dll,#1
  2⤵
  PID:2184