15f8c67211ac2c16d49697c2be090e058ab3c469b5ff0b35223291fbcdda5400

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 23:33

Target

299bcf5a0c0a0600da8cbf391a172848_JaffaCakes118.dll
Size

20KB
MD5

299bcf5a0c0a0600da8cbf391a172848
SHA1

a51b7e60a5ae58d25f842e2a3d1c2cf1b9c523fe
SHA256

15f8c67211ac2c16d49697c2be090e058ab3c469b5ff0b35223291fbcdda5400
SHA512

45f71f9c67df7d15eaabd65ec0b13fe0310d943f607ee340572b21b5eec318e2245235e14a9bba826a71bb80427b86cda81904b4b62a648ff72bc748dbc756b9
SSDEEP

384:b4M5J5HVWEN6T8nEGVBEZC7HMCDqeUes4UPGbmGITGFNaMkerubXTHDT0Xeun:bXJVVlIT8nt7EZwqeUes4UbG4GXaMkCB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1360	2224	rundll32.exe	29
PID 2224 wrote to memory of 1360	2224	rundll32.exe	29
PID 2224 wrote to memory of 1360	2224	rundll32.exe	29
PID 2224 wrote to memory of 1360	2224	rundll32.exe	29
PID 2224 wrote to memory of 1360	2224	rundll32.exe	29
PID 2224 wrote to memory of 1360	2224	rundll32.exe	29
PID 2224 wrote to memory of 1360	2224	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\299bcf5a0c0a0600da8cbf391a172848_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\299bcf5a0c0a0600da8cbf391a172848_JaffaCakes118.dll,#1
  2⤵
  PID:1360