376e9f6d05f8832a4f99b1fb19741e67f278d5417a178e769fb1b5bae914faea

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 19:14

Target

4b0ab55b1e2d99823c03345e6f4d4359_JaffaCakes118.dll
Size

97KB
MD5

4b0ab55b1e2d99823c03345e6f4d4359
SHA1

9d75d2d1426123c77d08bdbd2c2d6e6e4c9fb900
SHA256

376e9f6d05f8832a4f99b1fb19741e67f278d5417a178e769fb1b5bae914faea
SHA512

7ecc1dd144e7291d4f85803972c9a7e864f7528cb6df8832e6a667bc53eaf5b502a9da2676d891e72fafe4887505fe87b4ce607e40c4fc5c1ed3b1f757fb6d6b
SSDEEP

3072:z3BlVuG1lnetMNOehBJvIpgkFWhOb2aPNsGEK+V0H:LXcGlnetMNOehBJvIpgkFWhY2ap

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2472	1928	rundll32.exe	30
PID 1928 wrote to memory of 2472	1928	rundll32.exe	30
PID 1928 wrote to memory of 2472	1928	rundll32.exe	30
PID 1928 wrote to memory of 2472	1928	rundll32.exe	30
PID 1928 wrote to memory of 2472	1928	rundll32.exe	30
PID 1928 wrote to memory of 2472	1928	rundll32.exe	30
PID 1928 wrote to memory of 2472	1928	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b0ab55b1e2d99823c03345e6f4d4359_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b0ab55b1e2d99823c03345e6f4d4359_JaffaCakes118.dll,#1
  2⤵
  PID:2472