ee0e401fa9e58f6c172cd409dd8e752708a87411c5fde5171b7325283a7689c1

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 17:08

Target

42976cb6e8468893e7d6693688931849_JaffaCakes118.dll
Size

97KB
MD5

42976cb6e8468893e7d6693688931849
SHA1

5953346c389a0e251fd9b986db5b30e3c0228d3f
SHA256

ee0e401fa9e58f6c172cd409dd8e752708a87411c5fde5171b7325283a7689c1
SHA512

22b8963999161a86a30cad43715116c35ce3df85f7e2f9b5847857ab8b412d97f11132e6d700f17186dc8ca21e5786c5636c4120113fae61b496b9b8e15acb50
SSDEEP

1536:7NqXTqU6FJljUVm+Lv6QvHxQ5Q+/c3blyAsuHs4vC2rwlrs5YNwbcL1k0HS5S:ZomVJ6m+Lv6QvRQpybw7LGSFvC0yM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2364	2388	rundll32.exe	29
PID 2388 wrote to memory of 2364	2388	rundll32.exe	29
PID 2388 wrote to memory of 2364	2388	rundll32.exe	29
PID 2388 wrote to memory of 2364	2388	rundll32.exe	29
PID 2388 wrote to memory of 2364	2388	rundll32.exe	29
PID 2388 wrote to memory of 2364	2388	rundll32.exe	29
PID 2388 wrote to memory of 2364	2388	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42976cb6e8468893e7d6693688931849_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\42976cb6e8468893e7d6693688931849_JaffaCakes118.dll,#1
  2⤵
  PID:2364