025dc9e82f4e42931156a33d61f28a5db5dd4a8d27493ab9390c94a84d190e2c

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 14:19

Target

35148582ea526d72cfd5f11292358568_JaffaCakes118.dll
Size

84KB
MD5

35148582ea526d72cfd5f11292358568
SHA1

84d39ac11a01d309e5e14c795b1071f491064df7
SHA256

025dc9e82f4e42931156a33d61f28a5db5dd4a8d27493ab9390c94a84d190e2c
SHA512

12c17c6bdfffdc26af93f3b63c0974fc4a6f720dfced0ef8bf80136b3e5a17c69eb84e9418c91200bd208131b427e15ba40e45e7529fc240f0d0cb54f7cad591
SSDEEP

768:OYIAlScOcixtH4T/xoLgfPThDqc+PQgWKY04Bl+GJkVToVIY4Tam:fIAld5jfPThDqVQpKYr6GJEoP4Tam

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2108	2536	rundll32.exe	30
PID 2536 wrote to memory of 2108	2536	rundll32.exe	30
PID 2536 wrote to memory of 2108	2536	rundll32.exe	30
PID 2536 wrote to memory of 2108	2536	rundll32.exe	30
PID 2536 wrote to memory of 2108	2536	rundll32.exe	30
PID 2536 wrote to memory of 2108	2536	rundll32.exe	30
PID 2536 wrote to memory of 2108	2536	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35148582ea526d72cfd5f11292358568_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\35148582ea526d72cfd5f11292358568_JaffaCakes118.dll,#1
  2⤵
  PID:2108