0c8ca23f2466ae7ba96caa0697eed4d3c569baeeb353b687c4547f5d4b715cd9

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 18:21

Target

35daf1242490bd8fa6aa9df41d526bce_JaffaCakes118.dll
Size

62KB
MD5

35daf1242490bd8fa6aa9df41d526bce
SHA1

a0c3d8f2b6c80ebe285191a771b4509ed98041e6
SHA256

0c8ca23f2466ae7ba96caa0697eed4d3c569baeeb353b687c4547f5d4b715cd9
SHA512

0c4603515195f6dfa4dad2977a4d4393da941ea863055b1ac4dee9bdff661d6caaeaa0874cf88a1d5ba5883adb4d1f036d40feaf1861dab56ab1ed34ceb81196
SSDEEP

768:jTEgFjmlF191AtnDFVDvu+aB1ZdgyMkaNVZWLe6UAiOyVEODYNhFseYdqXba38T9:/4p91wD3ru+aB1ZdFM9Nb56kPDEsIu3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2700	2096	rundll32.exe	30
PID 2096 wrote to memory of 2700	2096	rundll32.exe	30
PID 2096 wrote to memory of 2700	2096	rundll32.exe	30
PID 2096 wrote to memory of 2700	2096	rundll32.exe	30
PID 2096 wrote to memory of 2700	2096	rundll32.exe	30
PID 2096 wrote to memory of 2700	2096	rundll32.exe	30
PID 2096 wrote to memory of 2700	2096	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35daf1242490bd8fa6aa9df41d526bce_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\35daf1242490bd8fa6aa9df41d526bce_JaffaCakes118.dll,#1
  2⤵
  PID:2700