6154066afd7ee3789c9ba5cf46f5ea705b414473b70ffe611bf2825f7e27074d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 17:43

Target

42b27f842d51a0cb04d53f68b6650001_JaffaCakes118.dll
Size

73KB
MD5

42b27f842d51a0cb04d53f68b6650001
SHA1

c8c7c80853fa5412b3ff85a8883e57a1d7f02479
SHA256

6154066afd7ee3789c9ba5cf46f5ea705b414473b70ffe611bf2825f7e27074d
SHA512

692f3745e51af2d96691ce27a9a19b2df6b0062c5e35cbba62a1e62be10928a921213686b974c072e389d9a3f97a326471daf471997796bc922d5b49c8228a0e
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1972	1300	rundll32.exe	30
PID 1300 wrote to memory of 1972	1300	rundll32.exe	30
PID 1300 wrote to memory of 1972	1300	rundll32.exe	30
PID 1300 wrote to memory of 1972	1300	rundll32.exe	30
PID 1300 wrote to memory of 1972	1300	rundll32.exe	30
PID 1300 wrote to memory of 1972	1300	rundll32.exe	30
PID 1300 wrote to memory of 1972	1300	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42b27f842d51a0cb04d53f68b6650001_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\42b27f842d51a0cb04d53f68b6650001_JaffaCakes118.dll,#1
  2⤵
  PID:1972