ba649bdb1346c45d79c7f4141a9ae8de8c8ee315a1f551f80706d5e77dfc9371

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 23:44

Target

474c0637a2fd6beea93c547c66136254_JaffaCakes118.dll
Size

61KB
MD5

474c0637a2fd6beea93c547c66136254
SHA1

e4e3b42fcd116466dcc70243d6a2a8aa11d28396
SHA256

ba649bdb1346c45d79c7f4141a9ae8de8c8ee315a1f551f80706d5e77dfc9371
SHA512

7d999461ea39ca6c7823b21a840612da7f657d55c43d85dce386c6e7047e9d945babdfc1e6715c90ef77a99bf588b8cd0bf1cc2ea0bebf8d208cda9cf333569a
SSDEEP

768:tsz5nqVim6u286v7KTWIOJ9RI95rwVmt5gMvyvK7wnimSqDgsD2bXb:P328a7KwRI95r2vMQC3qrQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2340	2356	rundll32.exe	30
PID 2356 wrote to memory of 2340	2356	rundll32.exe	30
PID 2356 wrote to memory of 2340	2356	rundll32.exe	30
PID 2356 wrote to memory of 2340	2356	rundll32.exe	30
PID 2356 wrote to memory of 2340	2356	rundll32.exe	30
PID 2356 wrote to memory of 2340	2356	rundll32.exe	30
PID 2356 wrote to memory of 2340	2356	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\474c0637a2fd6beea93c547c66136254_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\474c0637a2fd6beea93c547c66136254_JaffaCakes118.dll,#1
  2⤵
  PID:2340