41a048319938d36996d50c3a89a1eca1d0103a70386c48bc9261e25e1484fd2a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 08:16

Target

253ee45a10d54cce9aa3f55271f6b9e2_JaffaCakes118.dll
Size

104KB
MD5

253ee45a10d54cce9aa3f55271f6b9e2
SHA1

4a4d9c31dd6ad426641f22c9c81141d9898c2b1a
SHA256

41a048319938d36996d50c3a89a1eca1d0103a70386c48bc9261e25e1484fd2a
SHA512

e6d243657d086739ab14de1ab51949c0cc33d803566cf31a57080dd19e61a07c29679f78028c2ce7c608f383b63df1cb6ad88dc570455ba9ce432d9a628cf2b4
SSDEEP

1536:wIAevrWZQGOkKEElpKcOejiF1wDoLHko13eY6S7ffFMoc1gRcnLvYDFqU:lvrWZwfECponfLVflc+RWuF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2468	2480	rundll32.exe	28
PID 2480 wrote to memory of 2468	2480	rundll32.exe	28
PID 2480 wrote to memory of 2468	2480	rundll32.exe	28
PID 2480 wrote to memory of 2468	2480	rundll32.exe	28
PID 2480 wrote to memory of 2468	2480	rundll32.exe	28
PID 2480 wrote to memory of 2468	2480	rundll32.exe	28
PID 2480 wrote to memory of 2468	2480	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\253ee45a10d54cce9aa3f55271f6b9e2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\253ee45a10d54cce9aa3f55271f6b9e2_JaffaCakes118.dll,#1
  2⤵
  PID:2468