932e3610b2b48ccaae4d8288fb753f35dd415d69bff074e271b60b7d300be529

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 09:08

Target

452cbfa2f16c98a4f6399c2f23de35aa_JaffaCakes118.dll
Size

580KB
MD5

452cbfa2f16c98a4f6399c2f23de35aa
SHA1

7ab84600c8caf03ac4ffa8f2348d76bf204f0055
SHA256

932e3610b2b48ccaae4d8288fb753f35dd415d69bff074e271b60b7d300be529
SHA512

be3b4c8be87753894092f3b49a9d92ca607e02688a65f7929f4e7df00a927699d5a994e2075f537439a6d87afd1e3409a45ebb1ff8458f27074deb597f935f34
SSDEEP

6144:HtBnrRZR1sGAZ05b515kZ05b5vtBnrRZR1sGAZ05b5kZ05b515kZ05b5vtBnrRZJ:7nrLKZgnrLKDZgnrL

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2472	1864	rundll32.exe	30
PID 1864 wrote to memory of 2472	1864	rundll32.exe	30
PID 1864 wrote to memory of 2472	1864	rundll32.exe	30
PID 1864 wrote to memory of 2472	1864	rundll32.exe	30
PID 1864 wrote to memory of 2472	1864	rundll32.exe	30
PID 1864 wrote to memory of 2472	1864	rundll32.exe	30
PID 1864 wrote to memory of 2472	1864	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\452cbfa2f16c98a4f6399c2f23de35aa_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\452cbfa2f16c98a4f6399c2f23de35aa_JaffaCakes118.dll,#1
  2⤵
  PID:2472