d9e4c6e46ba45d48b94b6895a655f4e90407be0735e4551b0aa91912e8acfd82

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 16:12

Target

4268315a030350b81dfebcecfe859870_JaffaCakes118.dll
Size

72KB
MD5

4268315a030350b81dfebcecfe859870
SHA1

2ce6e1f327f43eb131ad561567e21bf6fdcb168d
SHA256

d9e4c6e46ba45d48b94b6895a655f4e90407be0735e4551b0aa91912e8acfd82
SHA512

1c2f242a810afac388c0783c7664678886eada8c07411c8c07702c286ef73c43942f3616d95bc8579c738acbfc0d6731fa6968e27e60a22cbb1c755fb6d286e5
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuP:C5UOq0ukgOK2l7aFQP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 2396	1076	rundll32.exe	30
PID 1076 wrote to memory of 2396	1076	rundll32.exe	30
PID 1076 wrote to memory of 2396	1076	rundll32.exe	30
PID 1076 wrote to memory of 2396	1076	rundll32.exe	30
PID 1076 wrote to memory of 2396	1076	rundll32.exe	30
PID 1076 wrote to memory of 2396	1076	rundll32.exe	30
PID 1076 wrote to memory of 2396	1076	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4268315a030350b81dfebcecfe859870_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4268315a030350b81dfebcecfe859870_JaffaCakes118.dll,#1
  2⤵
  PID:2396