4f6e16fc9a081a9257d5e4ff1f8e22c19986190501c230ec170061bb204719c8

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 05:15

Target

24c142cba6695cbcf5c895c7e17de2d2_JaffaCakes118.dll
Size

33KB
MD5

24c142cba6695cbcf5c895c7e17de2d2
SHA1

54c22afc3944fc147f063453b39cbe97ff799112
SHA256

4f6e16fc9a081a9257d5e4ff1f8e22c19986190501c230ec170061bb204719c8
SHA512

101c56fc25b2e20c0a7d429b39ec4ab47e6b06ee572ba8562271b0f159d342e7ddcbf846ff9b0936ba056622021f607caa517fab2a59b94133422db2a138f4e1
SSDEEP

768:WQp0BrQ+me0w5WYdDtruUe7QOyLjjhqDxRTJnu:WQp0Bk+smdDtSH7Q5LPkdRTJu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 3004	2764	rundll32.exe	28
PID 2764 wrote to memory of 3004	2764	rundll32.exe	28
PID 2764 wrote to memory of 3004	2764	rundll32.exe	28
PID 2764 wrote to memory of 3004	2764	rundll32.exe	28
PID 2764 wrote to memory of 3004	2764	rundll32.exe	28
PID 2764 wrote to memory of 3004	2764	rundll32.exe	28
PID 2764 wrote to memory of 3004	2764	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24c142cba6695cbcf5c895c7e17de2d2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24c142cba6695cbcf5c895c7e17de2d2_JaffaCakes118.dll,#1
  2⤵
  PID:3004