739404015c75525b09443c8520d14df9b034dbff1ea173893b399bae447eb81f

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 23:26

Target

43adae701eecdb19ba85f7a4a18e3344_JaffaCakes118.dll
Size

276KB
MD5

43adae701eecdb19ba85f7a4a18e3344
SHA1

5cb714dbb747d55f14c1ec23e0db995b8c6f1626
SHA256

739404015c75525b09443c8520d14df9b034dbff1ea173893b399bae447eb81f
SHA512

db93edb15ed40ccb29aa08c239a7bd96e51fb05ff061de7d5a0e1ca2e61735272ac1aeebb515499b260150c837b5e0c8088bc2c51455aa0883a97653d636a9ac
SSDEEP

3072:3/BPVuq7rcV7iraSFJ7DXpoLQ4lqw+nEVaOwve5XR/I0LKk2anPy2MmUZut99Rto:PBdJmCEVke5BVKk2anPygJvJE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2956	2220	rundll32.exe	30
PID 2220 wrote to memory of 2956	2220	rundll32.exe	30
PID 2220 wrote to memory of 2956	2220	rundll32.exe	30
PID 2220 wrote to memory of 2956	2220	rundll32.exe	30
PID 2220 wrote to memory of 2956	2220	rundll32.exe	30
PID 2220 wrote to memory of 2956	2220	rundll32.exe	30
PID 2220 wrote to memory of 2956	2220	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43adae701eecdb19ba85f7a4a18e3344_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\43adae701eecdb19ba85f7a4a18e3344_JaffaCakes118.dll,#1
  2⤵
  PID:2956