254ecc1b0a1839a7c52dee81e9f998f26830b85f15f2e55e84fcf017d5427497

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 14:38

Target

398a37d9fb84314ffbfb233e7fa9b73a_JaffaCakes118.dll
Size

73KB
MD5

398a37d9fb84314ffbfb233e7fa9b73a
SHA1

f7c515c1cdf3baab9ef3c3277f33d77c046f64bd
SHA256

254ecc1b0a1839a7c52dee81e9f998f26830b85f15f2e55e84fcf017d5427497
SHA512

811a663dc1f5a4c623701788cb73c35c4a550f9cfbd9441cca1acdc99e68998e873eea9604e946e7bd0e24710062b8bfe183782195572c310fd00a5eba5e3111
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2024	2156	rundll32.exe	30
PID 2156 wrote to memory of 2024	2156	rundll32.exe	30
PID 2156 wrote to memory of 2024	2156	rundll32.exe	30
PID 2156 wrote to memory of 2024	2156	rundll32.exe	30
PID 2156 wrote to memory of 2024	2156	rundll32.exe	30
PID 2156 wrote to memory of 2024	2156	rundll32.exe	30
PID 2156 wrote to memory of 2024	2156	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\398a37d9fb84314ffbfb233e7fa9b73a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\398a37d9fb84314ffbfb233e7fa9b73a_JaffaCakes118.dll,#1
  2⤵
  PID:2024