30531f98c4465334f95032426c1a9f6ac6bf6b5dfa34ac1f1169c2b3733efa56

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 08:44

Target

4f34e241f2b7f4f716d753adfeafc34a_JaffaCakes118.dll
Size

611KB
MD5

4f34e241f2b7f4f716d753adfeafc34a
SHA1

bb390bb40e9b6c6055bc32d6ee667ce66ef8c118
SHA256

30531f98c4465334f95032426c1a9f6ac6bf6b5dfa34ac1f1169c2b3733efa56
SHA512

b413e5b2b9a53af95a8464dc5ba610fb82d5efb80b78db23aee4bc38783fdcac1c8439983a4bb62c356474d7e544375f2dff7181294dbaf82d8b29be9613e8d6
SSDEEP

12288:/jEE1QYOuW7rPElRH6lsJ9SOkKB+C9L/lkPgoUQTFbTS+b:/jZBGERH6U9wKLNlagoNTFHS+b

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2344	1972	rundll32.exe	28
PID 1972 wrote to memory of 2344	1972	rundll32.exe	28
PID 1972 wrote to memory of 2344	1972	rundll32.exe	28
PID 1972 wrote to memory of 2344	1972	rundll32.exe	28
PID 1972 wrote to memory of 2344	1972	rundll32.exe	28
PID 1972 wrote to memory of 2344	1972	rundll32.exe	28
PID 1972 wrote to memory of 2344	1972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f34e241f2b7f4f716d753adfeafc34a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f34e241f2b7f4f716d753adfeafc34a_JaffaCakes118.dll,#1
  2⤵
  PID:2344