377a6ffd69d7cc259ddb780d9619ab2b880990e81fab793cf875a0f004558650

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 11:05

Target

41686d5385a84e3b3d8c46bbcfc8970e_JaffaCakes118.dll
Size

52KB
MD5

41686d5385a84e3b3d8c46bbcfc8970e
SHA1

fecb02370d8371ad1db3e28380b45430410ba985
SHA256

377a6ffd69d7cc259ddb780d9619ab2b880990e81fab793cf875a0f004558650
SHA512

ac3d303633ba8bd464f3caf9674c3bd235fd240747904668b0cb531e4073fca11ba37b689e203c82bfeda0b52c1183c7e75ed9028dc6c3d38348893b5e701cd6
SSDEEP

768:hvdCxTv3L1FyNjwbG5a4+f0qs4fiiGB/y6wJScDwtvb9MRWv/PbWv:rwKq8q9fvGBgjwtjKmbWv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1760	1972	rundll32.exe	29
PID 1972 wrote to memory of 1760	1972	rundll32.exe	29
PID 1972 wrote to memory of 1760	1972	rundll32.exe	29
PID 1972 wrote to memory of 1760	1972	rundll32.exe	29
PID 1972 wrote to memory of 1760	1972	rundll32.exe	29
PID 1972 wrote to memory of 1760	1972	rundll32.exe	29
PID 1972 wrote to memory of 1760	1972	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41686d5385a84e3b3d8c46bbcfc8970e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41686d5385a84e3b3d8c46bbcfc8970e_JaffaCakes118.dll,#1
  2⤵
  PID:1760