5746381439329d62d8d10da783b54d7e5073d964edad91da13d47a7016b2d9bc

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 10:35

Target

4969b055c2020c3ed0e98a389b332a3d_JaffaCakes118.dll
Size

72KB
MD5

4969b055c2020c3ed0e98a389b332a3d
SHA1

2bfa3902590f25952c2bcc7a790326f933f21cde
SHA256

5746381439329d62d8d10da783b54d7e5073d964edad91da13d47a7016b2d9bc
SHA512

35e1c1552b506279ec96d6e6740b0f4f358601886a69dde46e7e1f8ccf1f10bbabe7c7ff241800d86c8ed0ada95eb08faf35306b97079a69d5a1adab956316b1
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2536	2532	rundll32.exe	30
PID 2532 wrote to memory of 2536	2532	rundll32.exe	30
PID 2532 wrote to memory of 2536	2532	rundll32.exe	30
PID 2532 wrote to memory of 2536	2532	rundll32.exe	30
PID 2532 wrote to memory of 2536	2532	rundll32.exe	30
PID 2532 wrote to memory of 2536	2532	rundll32.exe	30
PID 2532 wrote to memory of 2536	2532	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4969b055c2020c3ed0e98a389b332a3d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4969b055c2020c3ed0e98a389b332a3d_JaffaCakes118.dll,#1
  2⤵
  PID:2536