84f22017f37b08a2bdd739a323f49e999b4d10ff2b66c0d7a122ce2b96771c2b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 05:36

Target

1635a433281238b10cb0d21ffed0055b_JaffaCakes118.dll
Size

1.1MB
MD5

1635a433281238b10cb0d21ffed0055b
SHA1

036a24f91d872246f8d2ad0281c8014485e8fd3e
SHA256

84f22017f37b08a2bdd739a323f49e999b4d10ff2b66c0d7a122ce2b96771c2b
SHA512

4a2d4890043364d73236dc7ff91cc0f571c94a0d7344da7f703ccd386c9c4739fde5a4b6d2fcf5141dd8a0f3c7e0d874690b604a41224bc640aaee4dc46b6c2c
SSDEEP

24576:f85aVxdXTOncL9vLm9EnZKlVW5ri3vg7f5DsBr29y6n0ig1gcyY:FVnhv69WZKlVWpAg7fS129rnC1gcyY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2004 wrote to memory of 1044	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1044	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1044	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1044	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1044	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1044	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1044	2004	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1635a433281238b10cb0d21ffed0055b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1635a433281238b10cb0d21ffed0055b_JaffaCakes118.dll,#1
2⤵
PID:1044