42ed01a887dd5472a3df96c1ea8ab36c532deaa58b679ec05569bdfde7a4116b

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 03:26

Target

33200bdb47eb1f387bf01a933b745641_JaffaCakes118.dll
Size

260KB
MD5

33200bdb47eb1f387bf01a933b745641
SHA1

b6c494b14d1b93cd3a8ce7a024688683e974cd3a
SHA256

42ed01a887dd5472a3df96c1ea8ab36c532deaa58b679ec05569bdfde7a4116b
SHA512

55ee6593439e3cb0f137038643ea565877db22aca364dbd27a6eb41677f0c072ceab26b2df9e11d2e4a13d62fbafff04eda3b285424a3d91bc50dab947cf32b6
SSDEEP

3072:j3wEHcdKKNqtAF/R9K6ANye9WZwfCm/Au4NnZhgMmKgVOVxr9y9zPoe2tb9aIAgv:d8vNqtA3Qb9K7nheSmkr32

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2788	2756	rundll32.exe	30
PID 2756 wrote to memory of 2788	2756	rundll32.exe	30
PID 2756 wrote to memory of 2788	2756	rundll32.exe	30
PID 2756 wrote to memory of 2788	2756	rundll32.exe	30
PID 2756 wrote to memory of 2788	2756	rundll32.exe	30
PID 2756 wrote to memory of 2788	2756	rundll32.exe	30
PID 2756 wrote to memory of 2788	2756	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33200bdb47eb1f387bf01a933b745641_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33200bdb47eb1f387bf01a933b745641_JaffaCakes118.dll,#1
  2⤵
  PID:2788