43e7afa032c8e33de1c9c5704729dd1ed703eb672e5fb8f0609e5fae8951fd56

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 23:47

Target

3f5b269a1c340804d4c41f4b3f70f0d9_JaffaCakes118.dll
Size

228KB
MD5

3f5b269a1c340804d4c41f4b3f70f0d9
SHA1

72125c2fe834c3cdeaaba7070ca36c7976148008
SHA256

43e7afa032c8e33de1c9c5704729dd1ed703eb672e5fb8f0609e5fae8951fd56
SHA512

72fd516faee077e425943fd1e88fb042a4f7e77c51b0592230fbf6b9cf3d526818659aa718e07f30e44a24499c252f0afacc0299f9aaf80c6c37463f9106de96
SSDEEP

3072:5/NrMHpfUkW+AvBMG6G38ZIVOd42ne/X9A/epHp4ks5yyU+pfr12h6e:ZdMJ8kW+AvBMG6G38m4T+9teEv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2148	2172	rundll32.exe	30
PID 2172 wrote to memory of 2148	2172	rundll32.exe	30
PID 2172 wrote to memory of 2148	2172	rundll32.exe	30
PID 2172 wrote to memory of 2148	2172	rundll32.exe	30
PID 2172 wrote to memory of 2148	2172	rundll32.exe	30
PID 2172 wrote to memory of 2148	2172	rundll32.exe	30
PID 2172 wrote to memory of 2148	2172	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f5b269a1c340804d4c41f4b3f70f0d9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f5b269a1c340804d4c41f4b3f70f0d9_JaffaCakes118.dll,#1
  2⤵
  PID:2148