4d9042f4e7b50bb1c9e3de7ce59e1a2c17a1a8542a6752a74c9d827d3979f8e0

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 02:03

Target

18656268c45a24af73d47bae2c08b6fc_JaffaCakes118.dll
Size

34KB
MD5

18656268c45a24af73d47bae2c08b6fc
SHA1

325e959c527eccfdbb81683719778e9b7ae08330
SHA256

4d9042f4e7b50bb1c9e3de7ce59e1a2c17a1a8542a6752a74c9d827d3979f8e0
SHA512

944ebee138cedf71af8a87a37a8912e5f15b593f34ae1fa4cd2e11030c5c214d22edd093d7c9287b1c01ccb70db0523f59e656e1995c92613b95971c442e1ac3
SSDEEP

768:qHhSzibNPn5f5dYQ7dCguH+sIIJGrw+Rm:qBKiFn5f5r7dCguH+sLIDRm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2656	2028	rundll32.exe	28
PID 2028 wrote to memory of 2656	2028	rundll32.exe	28
PID 2028 wrote to memory of 2656	2028	rundll32.exe	28
PID 2028 wrote to memory of 2656	2028	rundll32.exe	28
PID 2028 wrote to memory of 2656	2028	rundll32.exe	28
PID 2028 wrote to memory of 2656	2028	rundll32.exe	28
PID 2028 wrote to memory of 2656	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\18656268c45a24af73d47bae2c08b6fc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\18656268c45a24af73d47bae2c08b6fc_JaffaCakes118.dll,#1
  2⤵
  PID:2656