365b29d47de9cd780c08e2e3a602ecadab4d5cba4ac23251b4cc78bded1d2366

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 12:59

Target

45eb87dad234d60ca9092d1619a0d02b_JaffaCakes118.dll
Size

35KB
MD5

45eb87dad234d60ca9092d1619a0d02b
SHA1

2fe1890b7142400f987f1f8c826162e14af3e69d
SHA256

365b29d47de9cd780c08e2e3a602ecadab4d5cba4ac23251b4cc78bded1d2366
SHA512

a4c6ada90992b85126dfb7d3e79b574aaa7b73ccc0555c3c51985e2d489cd672d58d9de64f3777cf1d393225074a5e3073d51067a6921cc92532c8e9d2477027
SSDEEP

768:LnWy0L5TXpVQcqxieaSrM/W4uGes7UOFTcJ5hlD8oR3Y0eX:OLtXvQqSrMe/s7UOdcrXlRI0+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2364	2528	rundll32.exe	29
PID 2528 wrote to memory of 2364	2528	rundll32.exe	29
PID 2528 wrote to memory of 2364	2528	rundll32.exe	29
PID 2528 wrote to memory of 2364	2528	rundll32.exe	29
PID 2528 wrote to memory of 2364	2528	rundll32.exe	29
PID 2528 wrote to memory of 2364	2528	rundll32.exe	29
PID 2528 wrote to memory of 2364	2528	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45eb87dad234d60ca9092d1619a0d02b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45eb87dad234d60ca9092d1619a0d02b_JaffaCakes118.dll,#1
  2⤵
  PID:2364