5b1677fa8f838c8e3019ee917f3ad11c293a4be07222bc9e665e46c5ff40b6ed

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 14:56

Target

4650199bc66f36c98cc982b01120adac_JaffaCakes118.dll
Size

7KB
MD5

4650199bc66f36c98cc982b01120adac
SHA1

9119f042a315f994aa278ed6ad775139b7af71ac
SHA256

5b1677fa8f838c8e3019ee917f3ad11c293a4be07222bc9e665e46c5ff40b6ed
SHA512

e1fddd30c659414dc4f57edc21bd80984e346e6c522ce9b7e86d23fe692cb3df51dbc952dad8e31157b276ce38f9552de74019e13823fd500648fc2e9129c019
SSDEEP

192:xWiq8eF2NkeCKkOQGeT8U6C3XHPGR6JHDV7:y8ee71kOQGc8U6O3PGiV7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2004	2220	rundll32.exe	30
PID 2220 wrote to memory of 2004	2220	rundll32.exe	30
PID 2220 wrote to memory of 2004	2220	rundll32.exe	30
PID 2220 wrote to memory of 2004	2220	rundll32.exe	30
PID 2220 wrote to memory of 2004	2220	rundll32.exe	30
PID 2220 wrote to memory of 2004	2220	rundll32.exe	30
PID 2220 wrote to memory of 2004	2220	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4650199bc66f36c98cc982b01120adac_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4650199bc66f36c98cc982b01120adac_JaffaCakes118.dll,#1
  2⤵
  PID:2004