fcd85407caad73a1bdd8b2d95ab78f8a5474d2f662d9255f1c47dede23a5ad75

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 15:06

Target

071a5cb5d9413601b84553f7d7dbf9cd_JaffaCakes118.dll
Size

61KB
MD5

071a5cb5d9413601b84553f7d7dbf9cd
SHA1

78fca0aaccfd3e656d9bef8214936b46d2c9f01b
SHA256

fcd85407caad73a1bdd8b2d95ab78f8a5474d2f662d9255f1c47dede23a5ad75
SHA512

d8119053bab966b846102a1981b4a9ed99e1478a0b19fd0039e944e543aae7ffe67217e73ae92f5c96a7a051ce66e2760f843745f458f47689bb158beeee403d
SSDEEP

768:2nBXbBAirLK4lnwD8R/t2Yhir5Tx5SuJLibch:qZPdwDIV0H5PJ+ch

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2784	1744	rundll32.exe	28
PID 1744 wrote to memory of 2784	1744	rundll32.exe	28
PID 1744 wrote to memory of 2784	1744	rundll32.exe	28
PID 1744 wrote to memory of 2784	1744	rundll32.exe	28
PID 1744 wrote to memory of 2784	1744	rundll32.exe	28
PID 1744 wrote to memory of 2784	1744	rundll32.exe	28
PID 1744 wrote to memory of 2784	1744	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\071a5cb5d9413601b84553f7d7dbf9cd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\071a5cb5d9413601b84553f7d7dbf9cd_JaffaCakes118.dll,#1
  2⤵
  PID:2784