b85f7dc241b3f1c736635857bba6a980967b4979c8fe3bdf163783536efc9d04

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 09:55

Target

4130fee60d07e65230a062bf47b1ac3d_JaffaCakes118.dll
Size

46KB
MD5

4130fee60d07e65230a062bf47b1ac3d
SHA1

4efb5cabe16117708eebb214e7f0ed1eda51a5cf
SHA256

b85f7dc241b3f1c736635857bba6a980967b4979c8fe3bdf163783536efc9d04
SHA512

16517def781ef820008488deaa6db017a5a66d2164875ae5f32a281afea76d9cefa10c7a73fa81efe0d5f8b9571e6774ea107d5990247c2000160d63523b5ec9
SSDEEP

768:9xBtKtqyLUw4wy+nGAxS2oj6zjffR/grRf+xi49ajn/26muAXoIWUd+TUul2mex9:9G4hAFS2ouvfSFqor+fWUI5eziA9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2180	2276	rundll32.exe	31
PID 2276 wrote to memory of 2180	2276	rundll32.exe	31
PID 2276 wrote to memory of 2180	2276	rundll32.exe	31
PID 2276 wrote to memory of 2180	2276	rundll32.exe	31
PID 2276 wrote to memory of 2180	2276	rundll32.exe	31
PID 2276 wrote to memory of 2180	2276	rundll32.exe	31
PID 2276 wrote to memory of 2180	2276	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4130fee60d07e65230a062bf47b1ac3d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4130fee60d07e65230a062bf47b1ac3d_JaffaCakes118.dll,#1
  2⤵
  PID:2180