4a4888be9e4f3fe3f09f860b2d0d12f555746a8502e83fe86beea1e2ecb0eb96

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 18:11

Target

3e59d836bd0a3581316d34ecf2b5ee51_JaffaCakes118.dll
Size

62KB
MD5

3e59d836bd0a3581316d34ecf2b5ee51
SHA1

736692694a9025d5f2b1ace28c19784483c41fde
SHA256

4a4888be9e4f3fe3f09f860b2d0d12f555746a8502e83fe86beea1e2ecb0eb96
SHA512

0d115e022d81eb5960a30249b7307661b7f04618c19504e3ab2eb19973717b4bcb8c60edd9a053e329fb6a30fb8893c6c8e543f154529baa6f2f81c05dd8b12d
SSDEEP

1536:kbk4JSqgtrR1IGMlCwnW8iUZOgYQc25Q+uHFodnQr/2s9jeB:kbk4JSqYrRNMlCwnDirt2i+eoVQrL9jI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2052	2560	rundll32.exe	30
PID 2560 wrote to memory of 2052	2560	rundll32.exe	30
PID 2560 wrote to memory of 2052	2560	rundll32.exe	30
PID 2560 wrote to memory of 2052	2560	rundll32.exe	30
PID 2560 wrote to memory of 2052	2560	rundll32.exe	30
PID 2560 wrote to memory of 2052	2560	rundll32.exe	30
PID 2560 wrote to memory of 2052	2560	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e59d836bd0a3581316d34ecf2b5ee51_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e59d836bd0a3581316d34ecf2b5ee51_JaffaCakes118.dll,#1
  2⤵
  PID:2052