58bd7e3bc6fccc8ca19d48e83718f2757fa82403c4e0d2529d2c1e5c98dadf77

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 22:51

Target

4bc01a9d28794baf9b6d9a0de1d38e59_JaffaCakes118.dll
Size

57KB
MD5

4bc01a9d28794baf9b6d9a0de1d38e59
SHA1

e6cdfae9857d2c9729135801b178d21d9582ecea
SHA256

58bd7e3bc6fccc8ca19d48e83718f2757fa82403c4e0d2529d2c1e5c98dadf77
SHA512

46f3c2bf2b39604e52adab6d6264fe5d5a007e46351c26d765aef2d206e929b72e49db25cafcc059f1a4c2e2c2dad83f0cfcbb8a248b55f6ad83eda683377184
SSDEEP

1536:mtKxbweCZ7THaaEfwm+EnsMqRCZQNbBpeqbV:/krP6aEfwm+EsXdBpeyV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2024	3032	rundll32.exe	30
PID 3032 wrote to memory of 2024	3032	rundll32.exe	30
PID 3032 wrote to memory of 2024	3032	rundll32.exe	30
PID 3032 wrote to memory of 2024	3032	rundll32.exe	30
PID 3032 wrote to memory of 2024	3032	rundll32.exe	30
PID 3032 wrote to memory of 2024	3032	rundll32.exe	30
PID 3032 wrote to memory of 2024	3032	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bc01a9d28794baf9b6d9a0de1d38e59_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bc01a9d28794baf9b6d9a0de1d38e59_JaffaCakes118.dll,#1
  2⤵
  PID:2024