1d45b70491a090ffd3838cfa41d948c51523aaebf25dbeb0fa53d4f1ee260477

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 13:13

Target

45f7c5d90469ea131e5039008ac24b5d_JaffaCakes118.dll
Size

28KB
MD5

45f7c5d90469ea131e5039008ac24b5d
SHA1

ac57026b8b1a02aceca1f688e906414f9df4d1b0
SHA256

1d45b70491a090ffd3838cfa41d948c51523aaebf25dbeb0fa53d4f1ee260477
SHA512

f9d3905febc06a8f7754c7a8e36daf0d887cacff635cdec74bd866fedf44c8c70c625a50e2bb1a611e7912506016bd7d85c2975a651f3f2d4388becf59452ff8
SSDEEP

192:4B8RyBc2Mg0gg0NtWHAXl237ohsfLIJEo18NvZVhwsJBovVPq4jqdWDIdWdXyCdu:IkqmGhsfLNl9hfB0NqdWEWdiP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2700	2692	rundll32.exe	30
PID 2692 wrote to memory of 2700	2692	rundll32.exe	30
PID 2692 wrote to memory of 2700	2692	rundll32.exe	30
PID 2692 wrote to memory of 2700	2692	rundll32.exe	30
PID 2692 wrote to memory of 2700	2692	rundll32.exe	30
PID 2692 wrote to memory of 2700	2692	rundll32.exe	30
PID 2692 wrote to memory of 2700	2692	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45f7c5d90469ea131e5039008ac24b5d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45f7c5d90469ea131e5039008ac24b5d_JaffaCakes118.dll,#1
  2⤵
  PID:2700