04d169d9fa8fd89bad482cb440f16d2bf99b8f785374a833e7ec1c204d0a41db

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 23:48

Target

3d148c47eedd85e2b6421506430756f1_JaffaCakes118.dll
Size

192KB
MD5

3d148c47eedd85e2b6421506430756f1
SHA1

b895ab8d7d223fa080f689c3418b4fe3949b8251
SHA256

04d169d9fa8fd89bad482cb440f16d2bf99b8f785374a833e7ec1c204d0a41db
SHA512

fec846b166b84c35e224d7bc32263e4c57dbcd3e897a535869eae0d6be75de25d27c6d9b864a25d9d87605bbf1898ef9e27df5f43abd531464ac60a46f9d07cb
SSDEEP

3072:5NbpOnPsGqQTruHLD7RcQxKrrdNU0VAtrOpOOWxOv4Kn7qbjx7T/Hrms:5NbqaLD7RcukVAtSQOWcgWqbV77Lms

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 1824	2384	rundll32.exe	28
PID 2384 wrote to memory of 1824	2384	rundll32.exe	28
PID 2384 wrote to memory of 1824	2384	rundll32.exe	28
PID 2384 wrote to memory of 1824	2384	rundll32.exe	28
PID 2384 wrote to memory of 1824	2384	rundll32.exe	28
PID 2384 wrote to memory of 1824	2384	rundll32.exe	28
PID 2384 wrote to memory of 1824	2384	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d148c47eedd85e2b6421506430756f1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d148c47eedd85e2b6421506430756f1_JaffaCakes118.dll,#1
  2⤵
  PID:1824