4db8339f28eb8a067a79e68b80ed230b6580ea908525350587c69baf83e028b7

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 08:26

Target

3ca60f11bebf91a94bc81d3226e72cf8_JaffaCakes118.dll
Size

6KB
MD5

3ca60f11bebf91a94bc81d3226e72cf8
SHA1

41d77518a435546b3012d5b8a3cd51e1d9db58b1
SHA256

4db8339f28eb8a067a79e68b80ed230b6580ea908525350587c69baf83e028b7
SHA512

2a14683be58090edb01a47f29f375d6252f83aa1b54d92e4d259f5e257b0b166baf17592b6e4cc2487343f8195424620072ab28b520d57fbaa369f7e8302e48e
SSDEEP

96:PtAn5foqJUnuG6+uKQQAEt/B96MWQKPJfvxNMHx3hiPlpUVToW+PNcD:WaqQ6lOpWQ6HvMphiEVBD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1436	1756	rundll32.exe	30
PID 1756 wrote to memory of 1436	1756	rundll32.exe	30
PID 1756 wrote to memory of 1436	1756	rundll32.exe	30
PID 1756 wrote to memory of 1436	1756	rundll32.exe	30
PID 1756 wrote to memory of 1436	1756	rundll32.exe	30
PID 1756 wrote to memory of 1436	1756	rundll32.exe	30
PID 1756 wrote to memory of 1436	1756	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ca60f11bebf91a94bc81d3226e72cf8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ca60f11bebf91a94bc81d3226e72cf8_JaffaCakes118.dll,#1
  2⤵
  PID:1436