543fd3717968389ff55b2428753bbc4745dc0fcbb24642b33d2cd602db18946a

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 18:14

Target

29231ec27a176ca20352c6ae923d2494_JaffaCakes118.dll
Size

18KB
MD5

29231ec27a176ca20352c6ae923d2494
SHA1

5a740a1290bce2d05585848026f45994b271c46f
SHA256

543fd3717968389ff55b2428753bbc4745dc0fcbb24642b33d2cd602db18946a
SHA512

5bfe88754939131f7ac24b82d9c616c371b9cb4f1c4c44aa484516604d0249f5df8d56dd1d7942da6a05c6ccc2c91e3a014cfd175e45a3ddc4d54288b1d389e5
SSDEEP

384:kB1Ga3nQcWEXBXdzuQe0/6CdOgH0gdQQWWK1jBTZ:A3nhdPzlTOQtqWK1b

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2776	2768	rundll32.exe	30
PID 2768 wrote to memory of 2776	2768	rundll32.exe	30
PID 2768 wrote to memory of 2776	2768	rundll32.exe	30
PID 2768 wrote to memory of 2776	2768	rundll32.exe	30
PID 2768 wrote to memory of 2776	2768	rundll32.exe	30
PID 2768 wrote to memory of 2776	2768	rundll32.exe	30
PID 2768 wrote to memory of 2776	2768	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29231ec27a176ca20352c6ae923d2494_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\29231ec27a176ca20352c6ae923d2494_JaffaCakes118.dll,#1
  2⤵
  PID:2776