4f5a10628a7d5688d69dc9e501a985884e12486b9ea3da5a782f10f489bd0b4e

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 12:48

Target

41bb96e64769bb3bbdc6cd26322890c9_JaffaCakes118.dll
Size

231KB
MD5

41bb96e64769bb3bbdc6cd26322890c9
SHA1

bdfbb3fffa04be9c1b1a8fa9554c1ea1ce1d26ac
SHA256

4f5a10628a7d5688d69dc9e501a985884e12486b9ea3da5a782f10f489bd0b4e
SHA512

e53f6c9fe2aff096abb8c901465a16260da2c1dad5dd5cb2e37959446b02296cc82f0c784e12158c3a1b890630d22c57ecfcb35b81f08e48ab227e16658c8095
SSDEEP

6144:AFIjqTVXbmJHTkEEE3or9wz5+DMDVPJYiFUK9u2t6d:ACjqxrmZTrL3oCXPNQ2t6d

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2376	2348	rundll32.exe	30
PID 2348 wrote to memory of 2376	2348	rundll32.exe	30
PID 2348 wrote to memory of 2376	2348	rundll32.exe	30
PID 2348 wrote to memory of 2376	2348	rundll32.exe	30
PID 2348 wrote to memory of 2376	2348	rundll32.exe	30
PID 2348 wrote to memory of 2376	2348	rundll32.exe	30
PID 2348 wrote to memory of 2376	2348	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41bb96e64769bb3bbdc6cd26322890c9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41bb96e64769bb3bbdc6cd26322890c9_JaffaCakes118.dll,#1
  2⤵
  PID:2376