4ecb9b84d3ec9a7e4441cc4ce8189c6c3c5798ae465ebc5610851c1cc5a73613

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 01:41

Target

2a8b4608b3c64bfa855dd6965c896a45_JaffaCakes118.dll
Size

32KB
MD5

2a8b4608b3c64bfa855dd6965c896a45
SHA1

4f8f344547f6af6850fc0bb5d627901351f3fe81
SHA256

4ecb9b84d3ec9a7e4441cc4ce8189c6c3c5798ae465ebc5610851c1cc5a73613
SHA512

d41ccfdae53d7d8885e41458816988380eba921dc0f004a66306f39914314f05c3769575a90c0d67ac467484fa386ea6b38197dceea4ef5050f60c19c8c8930c
SSDEEP

768:hUDjbYjOVw9bJm7XJJvsiHBBzhA/ERghu8:h8wOVwhA7XJJvNHBpisRIB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2420	1316	rundll32.exe	28
PID 1316 wrote to memory of 2420	1316	rundll32.exe	28
PID 1316 wrote to memory of 2420	1316	rundll32.exe	28
PID 1316 wrote to memory of 2420	1316	rundll32.exe	28
PID 1316 wrote to memory of 2420	1316	rundll32.exe	28
PID 1316 wrote to memory of 2420	1316	rundll32.exe	28
PID 1316 wrote to memory of 2420	1316	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a8b4608b3c64bfa855dd6965c896a45_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a8b4608b3c64bfa855dd6965c896a45_JaffaCakes118.dll,#1
  2⤵
  PID:2420