4d11dc196eb2bd243bf61ea4def401df1a2df5d91ba277c694b99ba8bb5f56ac

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 14:32

Target

463a2a952348eaec68fb1497082d50aa_JaffaCakes118.dll
Size

36KB
MD5

463a2a952348eaec68fb1497082d50aa
SHA1

620060125aa75e852344a61263bd12f21fc1ff2d
SHA256

4d11dc196eb2bd243bf61ea4def401df1a2df5d91ba277c694b99ba8bb5f56ac
SHA512

2a96ba2ac4df0e9976c161f8aa4b90c352df5e599fe20ccbd13dac2d68d4c2a8312c2ca4bd16da541c7f3d54f74717e54ac246c74ab9a53fd25271e7eb24a660
SSDEEP

768:zWtf1lkAzsDbNNO+Ba0Z/7MQiSyCLvH/CODbhTR+6Q:41lkwK3O4aW7MzSzLvKOhTR+6Q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 1356	2920	rundll32.exe	31
PID 2920 wrote to memory of 1356	2920	rundll32.exe	31
PID 2920 wrote to memory of 1356	2920	rundll32.exe	31
PID 2920 wrote to memory of 1356	2920	rundll32.exe	31
PID 2920 wrote to memory of 1356	2920	rundll32.exe	31
PID 2920 wrote to memory of 1356	2920	rundll32.exe	31
PID 2920 wrote to memory of 1356	2920	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\463a2a952348eaec68fb1497082d50aa_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\463a2a952348eaec68fb1497082d50aa_JaffaCakes118.dll,#1
  2⤵
  PID:1356