5991c36ba988252dd810a9270d29e1ac514b7e369337e03e3184ec6f137b0c81

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 05:15

Target

485f769fbdbd394168242b5825697e06_JaffaCakes118.dll
Size

87KB
MD5

485f769fbdbd394168242b5825697e06
SHA1

37d62d01245076a35771a7bf3580a3f6fb9da99f
SHA256

5991c36ba988252dd810a9270d29e1ac514b7e369337e03e3184ec6f137b0c81
SHA512

e851c5c3c66a9e095d8ae5b4cee4a2732ff704f092d4db266b0e5439d76ca0fced82d44721fcb93b0e00b1c62fa722271f2f5b56ad9dbfc79f659eaef49449c6
SSDEEP

1536:47tCr4fRbd/yAJK1L8GoiqeBCJ4jPERbSQZgCIFm8ymk8D/fCXXj:4ZO4Rd/yv8GoZegvVSbymnDSnj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2168	3040	rundll32.exe	30
PID 3040 wrote to memory of 2168	3040	rundll32.exe	30
PID 3040 wrote to memory of 2168	3040	rundll32.exe	30
PID 3040 wrote to memory of 2168	3040	rundll32.exe	30
PID 3040 wrote to memory of 2168	3040	rundll32.exe	30
PID 3040 wrote to memory of 2168	3040	rundll32.exe	30
PID 3040 wrote to memory of 2168	3040	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\485f769fbdbd394168242b5825697e06_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\485f769fbdbd394168242b5825697e06_JaffaCakes118.dll,#1
  2⤵
  PID:2168