4b9d4590767713a34ef00104822be947727704cf29fc69076de5b97c9c96579e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 15:08

Target

0e85589cd4ea17cc07b5a1ddaa925c50_JaffaCakes118.dll
Size

33KB
MD5

0e85589cd4ea17cc07b5a1ddaa925c50
SHA1

251be02544931c679157d4cf445b46d456c6613b
SHA256

4b9d4590767713a34ef00104822be947727704cf29fc69076de5b97c9c96579e
SHA512

e9bb6baf006979de39e408002c541f03bd4ec3c7b133b0759b8341130f38ce0f2c0e646ba8eaeb0365a676b43054c408edf2296b409c837be308ce9c1a5962d6
SSDEEP

768:m0ceyVVtUn0J4gaed7hB7vrcFDfPta4SqO82tR8sCKOm:m0cXVn1ael7vrctfPsR1CK3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2324	1752	rundll32.exe	28
PID 1752 wrote to memory of 2324	1752	rundll32.exe	28
PID 1752 wrote to memory of 2324	1752	rundll32.exe	28
PID 1752 wrote to memory of 2324	1752	rundll32.exe	28
PID 1752 wrote to memory of 2324	1752	rundll32.exe	28
PID 1752 wrote to memory of 2324	1752	rundll32.exe	28
PID 1752 wrote to memory of 2324	1752	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e85589cd4ea17cc07b5a1ddaa925c50_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e85589cd4ea17cc07b5a1ddaa925c50_JaffaCakes118.dll,#1
  2⤵
  PID:2324