570e5f94480f22c6ef08d3d7a2d6e23c2940b104efc77639982cac3bd989424b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 11:35

Target

41806ef9709c40e1165890cddc3b32ff_JaffaCakes118.dll
Size

141KB
MD5

41806ef9709c40e1165890cddc3b32ff
SHA1

e6c0ed7e014a8007d739ef08d09d276c53f3eaeb
SHA256

570e5f94480f22c6ef08d3d7a2d6e23c2940b104efc77639982cac3bd989424b
SHA512

fdce74d44da25d0aa539a9b1616b431fdc211c584c1b2280ff3ecb4be9973da5d2a3a68674ec871423c7a5828a706add6f4d5f71c2c0122413e7f44f43268971
SSDEEP

3072:XECAJhkdOP17s/qaOi08OwyHxcnZGCCXl11PllV1V:XEvgOP17s/F08OaoCC1vl1V

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2580	2128	rundll32.exe	30
PID 2128 wrote to memory of 2580	2128	rundll32.exe	30
PID 2128 wrote to memory of 2580	2128	rundll32.exe	30
PID 2128 wrote to memory of 2580	2128	rundll32.exe	30
PID 2128 wrote to memory of 2580	2128	rundll32.exe	30
PID 2128 wrote to memory of 2580	2128	rundll32.exe	30
PID 2128 wrote to memory of 2580	2128	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41806ef9709c40e1165890cddc3b32ff_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41806ef9709c40e1165890cddc3b32ff_JaffaCakes118.dll,#1
  2⤵
  PID:2580