41c0dcd346dcda74b23e5aeeb81bf7f0b99e8d9d67235388813024f7275a6e79

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 04:37

Target

445675d01598dac65f50b7f07c49d6d2_JaffaCakes118.dll
Size

24KB
MD5

445675d01598dac65f50b7f07c49d6d2
SHA1

ec050aab7f4effaf11a99419dc0d38b7ec7ceb5a
SHA256

41c0dcd346dcda74b23e5aeeb81bf7f0b99e8d9d67235388813024f7275a6e79
SHA512

742d22b87b18d0fa15f4368473159b8e54c33b2fa7318882fe1407badb31fd9d96d0b45d34135feba79294e659e6601f3fdba68b85d90ac5e8e34a8e13c185a6
SSDEEP

384:vXGL0mu6j6RpOy5TMKQhBk7Du36D1Ypct5XY:vzmYRpOy5rQhgu36iat5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2596	2104	rundll32.exe	30
PID 2104 wrote to memory of 2596	2104	rundll32.exe	30
PID 2104 wrote to memory of 2596	2104	rundll32.exe	30
PID 2104 wrote to memory of 2596	2104	rundll32.exe	30
PID 2104 wrote to memory of 2596	2104	rundll32.exe	30
PID 2104 wrote to memory of 2596	2104	rundll32.exe	30
PID 2104 wrote to memory of 2596	2104	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\445675d01598dac65f50b7f07c49d6d2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\445675d01598dac65f50b7f07c49d6d2_JaffaCakes118.dll,#1
  2⤵
  PID:2596