9b9789072a7d0102a264948c92c1266350e4733f85b743f3c4fdf8cb2173ce74

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 05:59

Target

66668d670a0b543873a4e164c6085356_JaffaCakes118.dll
Size

94KB
MD5

66668d670a0b543873a4e164c6085356
SHA1

a6d884e92ad670a77bd04fd16c03226a86577caa
SHA256

9b9789072a7d0102a264948c92c1266350e4733f85b743f3c4fdf8cb2173ce74
SHA512

dc8903bd46f386a2986b1c348934b17b3d857a140d074ae48c8791b2fd1a7d9e6675349e8d190ff7c5ffe57c6b4e0b9bd2d9e19718e67546c2b63c1ee804a851
SSDEEP

1536:R+oQdim+2XZCAaEJwPxK1p+cP4NP9dSrBhR7kc7kH:8oQDbpEgwPxK1kcANmhRQcQH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2644	2468	rundll32.exe	30
PID 2468 wrote to memory of 2644	2468	rundll32.exe	30
PID 2468 wrote to memory of 2644	2468	rundll32.exe	30
PID 2468 wrote to memory of 2644	2468	rundll32.exe	30
PID 2468 wrote to memory of 2644	2468	rundll32.exe	30
PID 2468 wrote to memory of 2644	2468	rundll32.exe	30
PID 2468 wrote to memory of 2644	2468	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66668d670a0b543873a4e164c6085356_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66668d670a0b543873a4e164c6085356_JaffaCakes118.dll,#1
  2⤵
  PID:2644