6446f332299e8a9f72c56f111b5c15d6463b4dc8c8924db56e857fb463dd188d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 02:04

Target

374bb87e3d99ab9b765b6fb410ab1ed3_JaffaCakes118.dll
Size

56KB
MD5

374bb87e3d99ab9b765b6fb410ab1ed3
SHA1

c9c3699bfdb2066fa0486a40a222778a4ee4fc92
SHA256

6446f332299e8a9f72c56f111b5c15d6463b4dc8c8924db56e857fb463dd188d
SHA512

d77a0abbf9bc6a1e4376b43738dbebd50a330662cb0006f5aa0e9384ed763ce554b3b3ce33caa4dea098c2ba6dc2c1879c43ff0f365dd5c610e59149937740e1
SSDEEP

1536:N8EjVuV+bbVa0NazsfHbSb1IezJJBLVrpOgt1R+BoDaa:pigPNa4fHbSb1VFhrpfcc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1256	1056	rundll32.exe	28
PID 1056 wrote to memory of 1256	1056	rundll32.exe	28
PID 1056 wrote to memory of 1256	1056	rundll32.exe	28
PID 1056 wrote to memory of 1256	1056	rundll32.exe	28
PID 1056 wrote to memory of 1256	1056	rundll32.exe	28
PID 1056 wrote to memory of 1256	1056	rundll32.exe	28
PID 1056 wrote to memory of 1256	1056	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\374bb87e3d99ab9b765b6fb410ab1ed3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\374bb87e3d99ab9b765b6fb410ab1ed3_JaffaCakes118.dll,#1
  2⤵
  PID:1256