465b93fcc054ebac1f739b5547e6432054402448452a5fbae2d50fe6016a4d9e

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 12:44

Target

41b7058d3ebd2c6628e113a1a8d3373a_JaffaCakes118.dll
Size

36KB
MD5

41b7058d3ebd2c6628e113a1a8d3373a
SHA1

8c69027ec7a9009095351683a8691f01836fcd57
SHA256

465b93fcc054ebac1f739b5547e6432054402448452a5fbae2d50fe6016a4d9e
SHA512

d37b493fcebd279a8b4f69d925a2685394bb692c51657f41fa2e2c7fac68d22c1ce87c6b8c2e0a060440f3b71d0938640d5a68c0eb6f1d079866503e9c9dfe94
SSDEEP

768:FT1BNCkK5gVGxlaZql9J1oT1cIg7/fO3+a5hCDKR4plx8Mf9O:1nNCl5X/J12y5736+4QWR4pz9E

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2096	2032	rundll32.exe	30
PID 2032 wrote to memory of 2096	2032	rundll32.exe	30
PID 2032 wrote to memory of 2096	2032	rundll32.exe	30
PID 2032 wrote to memory of 2096	2032	rundll32.exe	30
PID 2032 wrote to memory of 2096	2032	rundll32.exe	30
PID 2032 wrote to memory of 2096	2032	rundll32.exe	30
PID 2032 wrote to memory of 2096	2032	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41b7058d3ebd2c6628e113a1a8d3373a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41b7058d3ebd2c6628e113a1a8d3373a_JaffaCakes118.dll,#1
  2⤵
  PID:2096