44d3af221208ef0cacd9ff9510fd774fd5ae7f1f75c61b730c17eb9aea63a5a3

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 03:45

Target

0c5bdcb5e8c4ee87594156ad27d813a3_JaffaCakes118.dll
Size

32KB
MD5

0c5bdcb5e8c4ee87594156ad27d813a3
SHA1

3734cc8db0fb15b5d9e14e17236c0dde2aeb7dc3
SHA256

44d3af221208ef0cacd9ff9510fd774fd5ae7f1f75c61b730c17eb9aea63a5a3
SHA512

aa8a2bcd5fe265f8b4dc180084b8b32c56db29fa083df1e08b6c0a809d8755da832f69265c42c57cace01e88dc3ceabf37581d26749793a5c0712e39d78ab911
SSDEEP

768:xYnadGs6LwZIZPlm6zbTrD9aWyXo0mAntwWiB9gKN:xDnuHzbTnkToJ6wfN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2992	2972	rundll32.exe	28
PID 2972 wrote to memory of 2992	2972	rundll32.exe	28
PID 2972 wrote to memory of 2992	2972	rundll32.exe	28
PID 2972 wrote to memory of 2992	2972	rundll32.exe	28
PID 2972 wrote to memory of 2992	2972	rundll32.exe	28
PID 2972 wrote to memory of 2992	2972	rundll32.exe	28
PID 2972 wrote to memory of 2992	2972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c5bdcb5e8c4ee87594156ad27d813a3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c5bdcb5e8c4ee87594156ad27d813a3_JaffaCakes118.dll,#1
  2⤵
  PID:2992