8c861c71ddc9e947e47f5bc62d7b673e3d96b557ceedbdf5f7ac336819a2fac6

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 23:09

Target

4bd05e94729b807e31a92efa6ca9a5ce_JaffaCakes118.dll
Size

280KB
MD5

4bd05e94729b807e31a92efa6ca9a5ce
SHA1

8c88e2b5d55992b422d94d9dc2476c85eb9ea393
SHA256

8c861c71ddc9e947e47f5bc62d7b673e3d96b557ceedbdf5f7ac336819a2fac6
SHA512

bf25eea60e108e677155495a5d639f2eaa194d26e255f690963bbf929d96c66812d27136177dd619f4e9b67e4c1b03fb0dbbf1a64634dd45b8dacb013824e757
SSDEEP

3072:fY6z8zVBPrOWOdgwYH5McNr3N96s7yV+L4lqw25YA5prBo37P+05vvtLnCwasK3e:J8XOFdiHKWXc7P+ChfKO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2664	2636	rundll32.exe	30
PID 2636 wrote to memory of 2664	2636	rundll32.exe	30
PID 2636 wrote to memory of 2664	2636	rundll32.exe	30
PID 2636 wrote to memory of 2664	2636	rundll32.exe	30
PID 2636 wrote to memory of 2664	2636	rundll32.exe	30
PID 2636 wrote to memory of 2664	2636	rundll32.exe	30
PID 2636 wrote to memory of 2664	2636	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bd05e94729b807e31a92efa6ca9a5ce_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bd05e94729b807e31a92efa6ca9a5ce_JaffaCakes118.dll,#1
  2⤵
  PID:2664