d4a55b73de6f1ab6302fa84a83bb8853bd9c6cdeea30e40011a855058c66dc5b

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 08:25

Target

3861c25f314063333d75d668ab1a2d41_JaffaCakes118.dll
Size

68KB
MD5

3861c25f314063333d75d668ab1a2d41
SHA1

7d98cc3c31a226220112170ba96e86a0e9c60930
SHA256

d4a55b73de6f1ab6302fa84a83bb8853bd9c6cdeea30e40011a855058c66dc5b
SHA512

b6c34206208a791d799cf2fc5b320634e4c33487ee3348ebdf232465d5bb42fb3209b52db7de13f80b8054aba91fc68f4e652452319626b45b434310a69f7770
SSDEEP

1536:OUwaXIlq2XrcJ7FzTIQdJIEoC+8zJnVopNk:OUwaUq2Xrc5MXmdVoLk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 1100	2552	rundll32.exe	29
PID 2552 wrote to memory of 1100	2552	rundll32.exe	29
PID 2552 wrote to memory of 1100	2552	rundll32.exe	29
PID 2552 wrote to memory of 1100	2552	rundll32.exe	29
PID 2552 wrote to memory of 1100	2552	rundll32.exe	29
PID 2552 wrote to memory of 1100	2552	rundll32.exe	29
PID 2552 wrote to memory of 1100	2552	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3861c25f314063333d75d668ab1a2d41_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3861c25f314063333d75d668ab1a2d41_JaffaCakes118.dll,#1
  2⤵
  PID:1100