b4ec9fb1ef3b36a88c0757682d36902d0f5b5e3fa159d3c7fbc19ad9fde493de

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 06:32

Target

24f45ec3ab1f95b6047a44cbe13514a2_JaffaCakes118.dll
Size

13KB
MD5

24f45ec3ab1f95b6047a44cbe13514a2
SHA1

8fe774a0a22bd6c6cf8ff375ea929bb665518188
SHA256

b4ec9fb1ef3b36a88c0757682d36902d0f5b5e3fa159d3c7fbc19ad9fde493de
SHA512

e72900f867000a6e3707e31d2829133d2aca012a39ea39315776121db0b96ea6dab4617a5bbb8dcf7629596e85253baf5ebefd4ea215e707a9abaca0341cf818
SSDEEP

384:cDGaLDNc4q4yLYfuSfvX8WfhGs5VYpAmmtGxYcQFY:cCWZc4B4aP7cvpA8ecv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2096	1704	rundll32.exe	28
PID 1704 wrote to memory of 2096	1704	rundll32.exe	28
PID 1704 wrote to memory of 2096	1704	rundll32.exe	28
PID 1704 wrote to memory of 2096	1704	rundll32.exe	28
PID 1704 wrote to memory of 2096	1704	rundll32.exe	28
PID 1704 wrote to memory of 2096	1704	rundll32.exe	28
PID 1704 wrote to memory of 2096	1704	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24f45ec3ab1f95b6047a44cbe13514a2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24f45ec3ab1f95b6047a44cbe13514a2_JaffaCakes118.dll,#1
  2⤵
  PID:2096