add4b70f7a3cb252e524ed7acb93895219c1d350078e903f18029c3dc3440311

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 09:36

Target

f57ad5b46c644611a75b79a118a6a6ea_JaffaCakes118.dll
Size

72KB
MD5

f57ad5b46c644611a75b79a118a6a6ea
SHA1

e1cbbd84d1c9d73d173133735670153e287e0fb6
SHA256

add4b70f7a3cb252e524ed7acb93895219c1d350078e903f18029c3dc3440311
SHA512

8e749ae58a6595c70c44e88f7a932fb379e4293b3b4388a80bf90f2950277d7a9dcb9445994efaeef014cda6dce5bc9c586787b63c909a2af40caca40f0f1b55
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuP:C5UOq0ukgOK2l7aFQP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2092	2100	rundll32.exe	28
PID 2100 wrote to memory of 2092	2100	rundll32.exe	28
PID 2100 wrote to memory of 2092	2100	rundll32.exe	28
PID 2100 wrote to memory of 2092	2100	rundll32.exe	28
PID 2100 wrote to memory of 2092	2100	rundll32.exe	28
PID 2100 wrote to memory of 2092	2100	rundll32.exe	28
PID 2100 wrote to memory of 2092	2100	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f57ad5b46c644611a75b79a118a6a6ea_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f57ad5b46c644611a75b79a118a6a6ea_JaffaCakes118.dll,#1
  2⤵
  PID:2092