6ca1048cd5c9171fdf470d5caddea47d00e31640fe2bc25406f80e8503da8d26

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 10:33

Target

4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll
Size

167KB
MD5

4967a971f16fdae1b8fbfe74621162da
SHA1

49b0766d33dd4a4df2ca0deb8307bc85537dd1bf
SHA256

6ca1048cd5c9171fdf470d5caddea47d00e31640fe2bc25406f80e8503da8d26
SHA512

3a8c03891cf89b42316109814a7ed931709eb441b24b7a5af632acad816f7874c503714500b2a74bd319a30b6c8351a886dd39b8730ed8c19ac8b2618c2ffadc
SSDEEP

3072:pcPWJ8t6fkk+t1Mp64c8NzTfEM0b3IHTQirbgjWZ:p2s8k+t1Y64c85fEl3IzzrEyZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1320	1660	rundll32.exe	30
PID 1660 wrote to memory of 1320	1660	rundll32.exe	30
PID 1660 wrote to memory of 1320	1660	rundll32.exe	30
PID 1660 wrote to memory of 1320	1660	rundll32.exe	30
PID 1660 wrote to memory of 1320	1660	rundll32.exe	30
PID 1660 wrote to memory of 1320	1660	rundll32.exe	30
PID 1660 wrote to memory of 1320	1660	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1
  2⤵
  PID:1320