4ef449384c577a30cda4866979579c6307d09f0f8b0bf9d317fc680991c05a2c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 14:12

Target

34fbce2710cdde4ad9ff41a9782444d5_JaffaCakes118.dll
Size

18KB
MD5

34fbce2710cdde4ad9ff41a9782444d5
SHA1

71dd03bcfcaf1d0b5b572acd2776d961b35440f1
SHA256

4ef449384c577a30cda4866979579c6307d09f0f8b0bf9d317fc680991c05a2c
SHA512

c476ad2bb843841612f3ca847fc485a809e3617f948831cd1bccdc7320f07e30ae28a078cb5e40f5be08cb5eed3c9752d6fb42a08b7e74265d804b6f5956a444
SSDEEP

384:+d8DOz2kQGyyCMy81IcydNkCYHP1ZGJ5rmyDHbjzPw3o:+d8sC3819ydGNu7Pw3

Score

1^/10

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1724	2192	rundll32.exe	28
PID 2192 wrote to memory of 1724	2192	rundll32.exe	28
PID 2192 wrote to memory of 1724	2192	rundll32.exe	28
PID 2192 wrote to memory of 1724	2192	rundll32.exe	28
PID 2192 wrote to memory of 1724	2192	rundll32.exe	28
PID 2192 wrote to memory of 1724	2192	rundll32.exe	28
PID 2192 wrote to memory of 1724	2192	rundll32.exe	28
PID 1724 wrote to memory of 2188	1724	rundll32.exe	29
PID 1724 wrote to memory of 2188	1724	rundll32.exe	29
PID 1724 wrote to memory of 2188	1724	rundll32.exe	29
PID 1724 wrote to memory of 2188	1724	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\34fbce2710cdde4ad9ff41a9782444d5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\34fbce2710cdde4ad9ff41a9782444d5_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\expand.exe
    expand.exe -r "C:\Users\Admin\AppData\Local\Temp\34fbce2710cdde4ad9ff41a9782444d5_JaffaCakes118.dll\..\360ini.cab"
    3⤵
    PID:2188