4fb191c15a92f1fdc2b1d102a9b50f39c1978b5334873cf72366f44f5dbb57d3

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 20:41

Target

0f751780a135d494fec1e22000deca9f_JaffaCakes118.dll
Size

38KB
MD5

0f751780a135d494fec1e22000deca9f
SHA1

276461b71c7d45cb8e4a2628ef6feb20a2414796
SHA256

4fb191c15a92f1fdc2b1d102a9b50f39c1978b5334873cf72366f44f5dbb57d3
SHA512

7181a9991eb7ed64baa22597d4f39f8bfd144c7d81f3b2b2909f1b079a16f6fe51bd00accfaf18aee8426f514d599a539989a3d9d0b7a6cb4f09933f0605150b
SSDEEP

768:HBCvx49gU5Cb8oByj9UlC7GfTaNSG7LYRDtF3Oy:h8x49RCPByjmE7GfTTMYRDtFP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2444	3016	rundll32.exe	28
PID 3016 wrote to memory of 2444	3016	rundll32.exe	28
PID 3016 wrote to memory of 2444	3016	rundll32.exe	28
PID 3016 wrote to memory of 2444	3016	rundll32.exe	28
PID 3016 wrote to memory of 2444	3016	rundll32.exe	28
PID 3016 wrote to memory of 2444	3016	rundll32.exe	28
PID 3016 wrote to memory of 2444	3016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f751780a135d494fec1e22000deca9f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f751780a135d494fec1e22000deca9f_JaffaCakes118.dll,#1
  2⤵
  PID:2444