9a835744b1659c3a650a7a79e812a55b2cfb30769130c73f8fd05a5af8d986c3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 19:56

Target

4b2bb86d4b97c29f4f6071ee561b82be_JaffaCakes118.dll
Size

175KB
MD5

4b2bb86d4b97c29f4f6071ee561b82be
SHA1

56ceeb5a805c8b65827f974161f409b3adbb7de6
SHA256

9a835744b1659c3a650a7a79e812a55b2cfb30769130c73f8fd05a5af8d986c3
SHA512

bb67d148f39465b0e5a8298d01c0b7565312b1bd2fb5522f1983609aa73b210460eb51f69f8d64d5e6c76f212e1e46ed7f013dc30e7fe6aa9441a879c3037099
SSDEEP

3072:gFordc4GojdMzWNUOkixjw1goe0qZCcGrFrY2WZ0cr2Ovm/DtqRz5Smy:uordcObNUOXxj1CceFmrS/DtqvS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1348	1972	rundll32.exe	30
PID 1972 wrote to memory of 1348	1972	rundll32.exe	30
PID 1972 wrote to memory of 1348	1972	rundll32.exe	30
PID 1972 wrote to memory of 1348	1972	rundll32.exe	30
PID 1972 wrote to memory of 1348	1972	rundll32.exe	30
PID 1972 wrote to memory of 1348	1972	rundll32.exe	30
PID 1972 wrote to memory of 1348	1972	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b2bb86d4b97c29f4f6071ee561b82be_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b2bb86d4b97c29f4f6071ee561b82be_JaffaCakes118.dll,#1
  2⤵
  PID:1348