a0dc6f723e80b01268aabe417de3e0f680fc89ae5447d2d9303afc36b8dda929

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 09:59

Target

4554b011648544ec557bdd8ecc6f44fa_JaffaCakes118.dll
Size

5KB
MD5

4554b011648544ec557bdd8ecc6f44fa
SHA1

5adf63b7393882cc8c719a5489e4cbc559c5a6c0
SHA256

a0dc6f723e80b01268aabe417de3e0f680fc89ae5447d2d9303afc36b8dda929
SHA512

c34e1dce328cae5a4621d6e42a77be9c0d98c9ded6fc9e92ece78b4f1c739c90d8507b859c9f43910756df4db361ac9a04c6cc3827cb7fedcd7bb6e77970c24a
SSDEEP

96:RPDi6iiGIaXowjJj8KE7milmQ1k6GsvvV0DB5UVMecB9FtYEV+jWUBH:RP+a1eSK+VSDcmF9PVU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2216	2308	rundll32.exe	31
PID 2308 wrote to memory of 2216	2308	rundll32.exe	31
PID 2308 wrote to memory of 2216	2308	rundll32.exe	31
PID 2308 wrote to memory of 2216	2308	rundll32.exe	31
PID 2308 wrote to memory of 2216	2308	rundll32.exe	31
PID 2308 wrote to memory of 2216	2308	rundll32.exe	31
PID 2308 wrote to memory of 2216	2308	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4554b011648544ec557bdd8ecc6f44fa_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4554b011648544ec557bdd8ecc6f44fa_JaffaCakes118.dll,#1
  2⤵
  PID:2216