a1ef9e2909109a9dd0c326cc65ea85b945e857ff566c5427022d7f0e03900227

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 14:23

Target

4a0d5b6d7fba008f00d1e0e2879e1820_JaffaCakes118.dll
Size

64KB
MD5

4a0d5b6d7fba008f00d1e0e2879e1820
SHA1

401f479efe37aa78526358ba614809530046f286
SHA256

a1ef9e2909109a9dd0c326cc65ea85b945e857ff566c5427022d7f0e03900227
SHA512

aa89a055308f3f8413b9672605f64fce51fef6e7d74d293cc1634c8606fdf7ba22750e7ab876003cf136513711b676f50df8f330bcedfff6fc721b071c710f8c
SSDEEP

1536:1MwJkeMny2kDO86nyztP5Q7LVr6eEqPcXv8MH867H+bOwi1TlFpN:WwKjkJ8yztPWRvPc5cw+Qp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1868	2080	rundll32.exe	30
PID 2080 wrote to memory of 1868	2080	rundll32.exe	30
PID 2080 wrote to memory of 1868	2080	rundll32.exe	30
PID 2080 wrote to memory of 1868	2080	rundll32.exe	30
PID 2080 wrote to memory of 1868	2080	rundll32.exe	30
PID 2080 wrote to memory of 1868	2080	rundll32.exe	30
PID 2080 wrote to memory of 1868	2080	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a0d5b6d7fba008f00d1e0e2879e1820_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a0d5b6d7fba008f00d1e0e2879e1820_JaffaCakes118.dll,#1
  2⤵
  PID:1868