a67d42b38fea1a0a4d3bb76672321250e76526dbd54b8fe79b6e251b3cc2bb07

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 20:28

Target

2db17d012d8a88c1074f26cc91fc0647_JaffaCakes118.dll
Size

89KB
MD5

2db17d012d8a88c1074f26cc91fc0647
SHA1

f0b44efdf4ce2415d0715d3e5bd3176bcdccc189
SHA256

a67d42b38fea1a0a4d3bb76672321250e76526dbd54b8fe79b6e251b3cc2bb07
SHA512

37b4956881206613ac921d338c3b9626386869ecc558e3faf1136b5cdb7b9e67f70b17c1d28270602df422431145a5277910c1f34552ae8032c91e55b634bd74
SSDEEP

1536:lwcaE7Dp39KiIrUcO5isscOi1fjz+L7X6NHvrObd+U1/+nH1:ldV39DgOEss1itjz+XX6NHvrOgU1/61

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2696	3016	rundll32.exe	30
PID 3016 wrote to memory of 2696	3016	rundll32.exe	30
PID 3016 wrote to memory of 2696	3016	rundll32.exe	30
PID 3016 wrote to memory of 2696	3016	rundll32.exe	30
PID 3016 wrote to memory of 2696	3016	rundll32.exe	30
PID 3016 wrote to memory of 2696	3016	rundll32.exe	30
PID 3016 wrote to memory of 2696	3016	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2db17d012d8a88c1074f26cc91fc0647_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2db17d012d8a88c1074f26cc91fc0647_JaffaCakes118.dll,#1
  2⤵
  PID:2696