e01d24ac11fb85f216a23b9129fc868301056e9ccf39a5d097f663ac529a1dd4

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 03:49

Target

4816ff0ba9286f3d67a021c536a3c411_JaffaCakes118.dll
Size

1.7MB
MD5

4816ff0ba9286f3d67a021c536a3c411
SHA1

34627959516da1a8ee0e10f1ccc6965d5d246108
SHA256

e01d24ac11fb85f216a23b9129fc868301056e9ccf39a5d097f663ac529a1dd4
SHA512

074ccd3382360d9441e54366875ff2c1016886ee338b1322dc09e70b2a696addad7bf6912196519fec33f7e9e11ae7c5dc039592b7a77a896f0f7787005c1b85
SSDEEP

24576:wPR06vWFqWvDgfSqM8s/BruxRf33F+F9HWLO5mfRycqF45z/DwZUicttzTWyrLtx:+WUP8spVtzTFLtObgoMX7e2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2452	3056	rundll32.exe	30
PID 3056 wrote to memory of 2452	3056	rundll32.exe	30
PID 3056 wrote to memory of 2452	3056	rundll32.exe	30
PID 3056 wrote to memory of 2452	3056	rundll32.exe	30
PID 3056 wrote to memory of 2452	3056	rundll32.exe	30
PID 3056 wrote to memory of 2452	3056	rundll32.exe	30
PID 3056 wrote to memory of 2452	3056	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4816ff0ba9286f3d67a021c536a3c411_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4816ff0ba9286f3d67a021c536a3c411_JaffaCakes118.dll,#1
  2⤵
  PID:2452