0bbf6f8b688665ecba1548e43903d6019b140020f10195e2a08d3cdbddeabb33

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 01:20

Target

62379db8ebc83f85bd02d3d05c94b71d_JaffaCakes118.dll
Size

57KB
MD5

62379db8ebc83f85bd02d3d05c94b71d
SHA1

480ae79e00ae47358f4a3e03eca86de577befe51
SHA256

0bbf6f8b688665ecba1548e43903d6019b140020f10195e2a08d3cdbddeabb33
SHA512

89a314de7626e9812b82f4063aa97816b19630de1769674d9ff2abef666553ed97929568ed1c7802c923e18782fcb115291397ced5f53e9b125492a6797eb165
SSDEEP

1536:qmmMttwBSvdHIBe5ydkqGSMC2udMQ11Zal9LMhYa:QMPwB3BWydcCkGZo6H

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2012	2372	rundll32.exe	31
PID 2372 wrote to memory of 2012	2372	rundll32.exe	31
PID 2372 wrote to memory of 2012	2372	rundll32.exe	31
PID 2372 wrote to memory of 2012	2372	rundll32.exe	31
PID 2372 wrote to memory of 2012	2372	rundll32.exe	31
PID 2372 wrote to memory of 2012	2372	rundll32.exe	31
PID 2372 wrote to memory of 2012	2372	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\62379db8ebc83f85bd02d3d05c94b71d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\62379db8ebc83f85bd02d3d05c94b71d_JaffaCakes118.dll,#1
  2⤵
  PID:2012