9c29be8fc9ca3c29f6c565737e08db432644ce3709b63a94e07ae9ba81b2b7ae

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 06:33

Target

4ed3df377f3ee11c0eaa7e4dee62a6d2_JaffaCakes118.dll
Size

375KB
MD5

4ed3df377f3ee11c0eaa7e4dee62a6d2
SHA1

ba1896b479ded891a08b24b66cdd4f769f0e3344
SHA256

9c29be8fc9ca3c29f6c565737e08db432644ce3709b63a94e07ae9ba81b2b7ae
SHA512

a2ecd9f35b7c209e02ae1ac1ec3396b41db7e64c37c0996b21638a020b616716ff033b3edce7885708bf0c8efc8f9d92baabec7f72efb77bf0ca09d027ce7442
SSDEEP

6144:dHv4WIYGoDlbSX1MP4RuoVdavtvVzMGsO8NGtlbO9HOXr2f/LD8lwznqQZF3PJII:FjDheX1MP4iLbcS2ff8lwauh5Vg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1216	1520	rundll32.exe	28
PID 1520 wrote to memory of 1216	1520	rundll32.exe	28
PID 1520 wrote to memory of 1216	1520	rundll32.exe	28
PID 1520 wrote to memory of 1216	1520	rundll32.exe	28
PID 1520 wrote to memory of 1216	1520	rundll32.exe	28
PID 1520 wrote to memory of 1216	1520	rundll32.exe	28
PID 1520 wrote to memory of 1216	1520	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ed3df377f3ee11c0eaa7e4dee62a6d2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ed3df377f3ee11c0eaa7e4dee62a6d2_JaffaCakes118.dll,#1
  2⤵
  PID:1216