410e88022e01a1ee3b970587d5395986db4125af5a085f65444677fc582a4b22

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 21:19

Target

3abf4c9de74c7a7442bae7024d4212df_JaffaCakes118.dll
Size

94KB
MD5

3abf4c9de74c7a7442bae7024d4212df
SHA1

4e940396d118357c6b4b886edc0cb223d1ec7700
SHA256

410e88022e01a1ee3b970587d5395986db4125af5a085f65444677fc582a4b22
SHA512

40a7824a5912c00ceeeab9b3f50224ca52aa6f37b1f624c6d6d3ecb3c4fcf1e6ae4e076d0aaa9ca1a6ed222a4455285f146e79e0864d03229534342e2adedce6
SSDEEP

1536:y+ZQdim+2XZCAaEJwPxK1pPcP4NPXdSr87ilZPSHPw:/ZQDbpEgwPxK1FcAN77i/AI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2068	2012	rundll32.exe	30
PID 2012 wrote to memory of 2068	2012	rundll32.exe	30
PID 2012 wrote to memory of 2068	2012	rundll32.exe	30
PID 2012 wrote to memory of 2068	2012	rundll32.exe	30
PID 2012 wrote to memory of 2068	2012	rundll32.exe	30
PID 2012 wrote to memory of 2068	2012	rundll32.exe	30
PID 2012 wrote to memory of 2068	2012	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3abf4c9de74c7a7442bae7024d4212df_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3abf4c9de74c7a7442bae7024d4212df_JaffaCakes118.dll,#1
  2⤵
  PID:2068