efd738cbae665485888a4cc8bcefa97869e0f6588c6a989bc4d1ef304cdd6848

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 12:40

Target

45da44c47f0f076cafa630332ccd63ed_JaffaCakes118.dll
Size

72KB
MD5

45da44c47f0f076cafa630332ccd63ed
SHA1

498afbd6d959854d64266cddc63f834bce577252
SHA256

efd738cbae665485888a4cc8bcefa97869e0f6588c6a989bc4d1ef304cdd6848
SHA512

19da2e13026f3b590fc2cceacde9519aa5d4673934464b19179e5bf079fdc00802b1c4cf8e06bd2b8e9580008226e431587f16d8f6da06d1cc7d958aef845076
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 3032	2412	rundll32.exe	30
PID 2412 wrote to memory of 3032	2412	rundll32.exe	30
PID 2412 wrote to memory of 3032	2412	rundll32.exe	30
PID 2412 wrote to memory of 3032	2412	rundll32.exe	30
PID 2412 wrote to memory of 3032	2412	rundll32.exe	30
PID 2412 wrote to memory of 3032	2412	rundll32.exe	30
PID 2412 wrote to memory of 3032	2412	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45da44c47f0f076cafa630332ccd63ed_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45da44c47f0f076cafa630332ccd63ed_JaffaCakes118.dll,#1
  2⤵
  PID:3032