d514dec046feb20c0e8d9f915596d3c6dafe22e1f587f3206149aecec28d823d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 10:05

Target

413a559cc6a546abf2b553a810cc2211_JaffaCakes118.dll
Size

341KB
MD5

413a559cc6a546abf2b553a810cc2211
SHA1

dd4d8b13711d9bf6aef1e5a0573df9d27e1cb8e7
SHA256

d514dec046feb20c0e8d9f915596d3c6dafe22e1f587f3206149aecec28d823d
SHA512

21abf2def8ca0df65ebe0508d7847cd728f7ddb811f755d07c6737fee29309b87e403adeb8b2bae575f2f2be2a0c9eed4463339103dec1b6c622d3d610b4d39e
SSDEEP

6144:BEVi8ydU26FTFP9bhgu08AMK3VnT3FMCEMl9FT/DNRHE:5yJbBZAMK3VnT1VE+/BRHE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2676	2668	rundll32.exe	31
PID 2668 wrote to memory of 2676	2668	rundll32.exe	31
PID 2668 wrote to memory of 2676	2668	rundll32.exe	31
PID 2668 wrote to memory of 2676	2668	rundll32.exe	31
PID 2668 wrote to memory of 2676	2668	rundll32.exe	31
PID 2668 wrote to memory of 2676	2668	rundll32.exe	31
PID 2668 wrote to memory of 2676	2668	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\413a559cc6a546abf2b553a810cc2211_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\413a559cc6a546abf2b553a810cc2211_JaffaCakes118.dll,#1
  2⤵
  PID:2676