9f7b32a7a4261e9e4ccf3b579bea6881b25d43e5242cbb80ad69ab50fb0c8957

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 11:16

Target

459311d96a0f0954115f47c05439d529_JaffaCakes118.dll
Size

137KB
MD5

459311d96a0f0954115f47c05439d529
SHA1

6ce1970af3df79a3b13154ea1fd5db28512d1283
SHA256

9f7b32a7a4261e9e4ccf3b579bea6881b25d43e5242cbb80ad69ab50fb0c8957
SHA512

7d372fc82945cd9501e6ace53a0eb36b17434a9b9e146c1867cc59248e98f001c3e48432d789dc3d140f330fdcbb82a221230e218547afafb43a838ae5836c34
SSDEEP

3072:uWp36jFpsIuo3c1OK+yBaMm31obl4vZwgmvchZ7lWz90+4WH:uWpKjzuo3vMpblFOMzu38

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2084	2316	rundll32.exe	30
PID 2316 wrote to memory of 2084	2316	rundll32.exe	30
PID 2316 wrote to memory of 2084	2316	rundll32.exe	30
PID 2316 wrote to memory of 2084	2316	rundll32.exe	30
PID 2316 wrote to memory of 2084	2316	rundll32.exe	30
PID 2316 wrote to memory of 2084	2316	rundll32.exe	30
PID 2316 wrote to memory of 2084	2316	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\459311d96a0f0954115f47c05439d529_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\459311d96a0f0954115f47c05439d529_JaffaCakes118.dll,#1
  2⤵
  PID:2084