6b1ef5ab7adaf38bcef07bdbbb4c5eb72d32ea037f75b8496fa98e096556204a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 16:41

Target

4c0db1b19b99f3f603ed362c44c69b58_JaffaCakes118.dll
Size

95KB
MD5

4c0db1b19b99f3f603ed362c44c69b58
SHA1

db3037a169563eb64141fb4dee300d30cafff37f
SHA256

6b1ef5ab7adaf38bcef07bdbbb4c5eb72d32ea037f75b8496fa98e096556204a
SHA512

8cf5dd0018cad61df1176471808b241dee986926ceee60b1f1735e1a4129d3bfb0046c7466ebce1aa28239199e12a7a221777a0675b266d8ade945d9f405b452
SSDEEP

1536:XATDaCnID5+bsh2dt1RFpOh7vBW1iWyhaloaE0FTkxkUieKFfe6W60go:XwVA5+bsh2dtjcZQYQT+bw1W6G

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2984	1700	rundll32.exe	28
PID 1700 wrote to memory of 2984	1700	rundll32.exe	28
PID 1700 wrote to memory of 2984	1700	rundll32.exe	28
PID 1700 wrote to memory of 2984	1700	rundll32.exe	28
PID 1700 wrote to memory of 2984	1700	rundll32.exe	28
PID 1700 wrote to memory of 2984	1700	rundll32.exe	28
PID 1700 wrote to memory of 2984	1700	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c0db1b19b99f3f603ed362c44c69b58_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c0db1b19b99f3f603ed362c44c69b58_JaffaCakes118.dll,#1
  2⤵
  PID:2984