4b8572acd3dc4ea84d33b59857ddb91d28689bfad362cc4c4afb2cfc4a58b020

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 23:56

Target

fb73f0e206a03aa8852b1b495dc2b6f7_JaffaCakes118.dll
Size

54KB
MD5

fb73f0e206a03aa8852b1b495dc2b6f7
SHA1

abb47ce971875c34fbca03ce1b390122c9fe4b58
SHA256

4b8572acd3dc4ea84d33b59857ddb91d28689bfad362cc4c4afb2cfc4a58b020
SHA512

4f3404b480f26b2f266a6d5e5ba3237972f16ac00112d429e5b857f1184a52dffaf08db384bb86863564ab2fe96bfe544b2875b55bbf02f489df0549e160340c
SSDEEP

768:StA0owz57m4vOyECCT4/D/HctbaVQBWq7kMFmB/u3OzLTrU7yA9/SYIOcVnToIf1:StAazFvOyEC//7AQYIOcVnToIfSg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2632	2820	rundll32.exe	28
PID 2820 wrote to memory of 2632	2820	rundll32.exe	28
PID 2820 wrote to memory of 2632	2820	rundll32.exe	28
PID 2820 wrote to memory of 2632	2820	rundll32.exe	28
PID 2820 wrote to memory of 2632	2820	rundll32.exe	28
PID 2820 wrote to memory of 2632	2820	rundll32.exe	28
PID 2820 wrote to memory of 2632	2820	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb73f0e206a03aa8852b1b495dc2b6f7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb73f0e206a03aa8852b1b495dc2b6f7_JaffaCakes118.dll,#1
  2⤵
  PID:2632