de6c40b59dbfae6f8c7693f958797f5d646ca63676e0fc700c6f977a3c89afe6

Analysis

max time kernel
13s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 23:26

Target

43ad86b7e5e4161c101888a31d91a59f_JaffaCakes118.dll
Size

23KB
MD5

43ad86b7e5e4161c101888a31d91a59f
SHA1

dcd9fa6ea791ef8d4a735e7285e0981faee640b4
SHA256

de6c40b59dbfae6f8c7693f958797f5d646ca63676e0fc700c6f977a3c89afe6
SHA512

a8cc6df8535474d7e705478dc2e630bcc0125afeb9bbc4b03aeae76ec36ff85228286344f0560bd965d77a99b3214b546d7d39b35428d9695a7d98e6e8558981
SSDEEP

384:XvxfA7SZf2GKIpbZCXno5zEGdQN7bXFr1QHM3mNFX81x:XZuSZ+G2adCXFr1QHM3o81x

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1360	2224	rundll32.exe	29
PID 2224 wrote to memory of 1360	2224	rundll32.exe	29
PID 2224 wrote to memory of 1360	2224	rundll32.exe	29
PID 2224 wrote to memory of 1360	2224	rundll32.exe	29
PID 2224 wrote to memory of 1360	2224	rundll32.exe	29
PID 2224 wrote to memory of 1360	2224	rundll32.exe	29
PID 2224 wrote to memory of 1360	2224	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43ad86b7e5e4161c101888a31d91a59f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\43ad86b7e5e4161c101888a31d91a59f_JaffaCakes118.dll,#1
  2⤵
  PID:1360