6f20b0711c23d865729a04f1285c89cb3da14f281bbd0f4fecabfbafdd7494f2

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 08:25

Target

4508bb5297f4c61ddf3a6f57bae88697_JaffaCakes118.dll
Size

9KB
MD5

4508bb5297f4c61ddf3a6f57bae88697
SHA1

6649cb64d9b2fe9e5f36638f09510f2e7e1577c5
SHA256

6f20b0711c23d865729a04f1285c89cb3da14f281bbd0f4fecabfbafdd7494f2
SHA512

dc669f167c51ad629f0c4b6971372432628bff106e4745f9b065015840e7ac11c2c14eeadb55d0464e002e697a56d0b6d24cd739efc1a7a3cb7a28f710a5adf7
SSDEEP

96:q1V7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG34bd:kuwEt8rsTUtPLzKNWSYWF4bd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2120	2972	rundll32.exe	31
PID 2972 wrote to memory of 2120	2972	rundll32.exe	31
PID 2972 wrote to memory of 2120	2972	rundll32.exe	31
PID 2972 wrote to memory of 2120	2972	rundll32.exe	31
PID 2972 wrote to memory of 2120	2972	rundll32.exe	31
PID 2972 wrote to memory of 2120	2972	rundll32.exe	31
PID 2972 wrote to memory of 2120	2972	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4508bb5297f4c61ddf3a6f57bae88697_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4508bb5297f4c61ddf3a6f57bae88697_JaffaCakes118.dll,#1
  2⤵
  PID:2120