95a09af2bc12423d17091dc9aa0b981a031f97a2bc08466dd84a338cc703ee10

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 11:14

Target

057a4e7384db77867f2055e04cb1d395_JaffaCakes118.dll
Size

5KB
MD5

057a4e7384db77867f2055e04cb1d395
SHA1

51ca501cb6d666fa017004988abc44ea294935cb
SHA256

95a09af2bc12423d17091dc9aa0b981a031f97a2bc08466dd84a338cc703ee10
SHA512

948f0494e8fd53641eaa68110dd89e5fff7653b1394879a34be8eabb2fced08d36d6acfd3df40616fc6a3cfef7d2c4727987c7a028414d58ffbe229544759a3c
SSDEEP

24:eH1GSQx7AUp/ViO/TR7L5Rn0XT/KcIXz9CCPTPm6wi3ynica1e7aee:yU7hiQT/liCjD06PmVi3++e7r

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2584	2444	rundll32.exe	28
PID 2444 wrote to memory of 2584	2444	rundll32.exe	28
PID 2444 wrote to memory of 2584	2444	rundll32.exe	28
PID 2444 wrote to memory of 2584	2444	rundll32.exe	28
PID 2444 wrote to memory of 2584	2444	rundll32.exe	28
PID 2444 wrote to memory of 2584	2444	rundll32.exe	28
PID 2444 wrote to memory of 2584	2444	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\057a4e7384db77867f2055e04cb1d395_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\057a4e7384db77867f2055e04cb1d395_JaffaCakes118.dll,#1
  2⤵
  PID:2584