bab38139bddf73fd8d2a64931768b5f03205aea31553c7c20983a5eece0ebc97

Analysis

max time kernel
10s
max time network
15s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 16:14

Target

4691879190973767d0e5784c0c98a91f_JaffaCakes118.dll
Size

34KB
MD5

4691879190973767d0e5784c0c98a91f
SHA1

a0503b90d7c12003eebcdcff6f4e94ca9bef146e
SHA256

bab38139bddf73fd8d2a64931768b5f03205aea31553c7c20983a5eece0ebc97
SHA512

414baafb1f2143d044598c6f2f5c7dc6409f71355757df6a711cfbac6bc0c8763a456be47f68dbb348ce27396fb1ec8b60a486292080da8e075456a389cc156d
SSDEEP

768:YlOTjhcY4591BlnONd7hFyDhChw59FR6Cjf:YlOTL45jy7hF4M6XFR6Cj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 916	2556	rundll32.exe	29
PID 2556 wrote to memory of 916	2556	rundll32.exe	29
PID 2556 wrote to memory of 916	2556	rundll32.exe	29
PID 2556 wrote to memory of 916	2556	rundll32.exe	29
PID 2556 wrote to memory of 916	2556	rundll32.exe	29
PID 2556 wrote to memory of 916	2556	rundll32.exe	29
PID 2556 wrote to memory of 916	2556	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4691879190973767d0e5784c0c98a91f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4691879190973767d0e5784c0c98a91f_JaffaCakes118.dll,#1
  2⤵
  PID:916