73ecb9c4706f084958ddbb1c132391fcad77a292d114e9c144280b6e834744cc

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 20:59

Target

4b5f2d076c4922093e9e8efb48761218_JaffaCakes118.dll
Size

268KB
MD5

4b5f2d076c4922093e9e8efb48761218
SHA1

3934ebfa8475299923d7cc3579c71a1ea79c58f8
SHA256

73ecb9c4706f084958ddbb1c132391fcad77a292d114e9c144280b6e834744cc
SHA512

b046e6402cdddeb63ce516d6df9b90ae6dc66d01ad0550f0cd35c640d66c750488afbf3c1bb756b8a4b8ede7387948622f03030e69ef44a7d172c263a018adfc
SSDEEP

3072:718Co09DnHzWSjggQ7eUPMuC4lqwxY0zXWgdBX9z30s4eAUpEj+yDOHwyYgy72H0:7aCoM7xi3xJP6v

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2352	2508	rundll32.exe	30
PID 2508 wrote to memory of 2352	2508	rundll32.exe	30
PID 2508 wrote to memory of 2352	2508	rundll32.exe	30
PID 2508 wrote to memory of 2352	2508	rundll32.exe	30
PID 2508 wrote to memory of 2352	2508	rundll32.exe	30
PID 2508 wrote to memory of 2352	2508	rundll32.exe	30
PID 2508 wrote to memory of 2352	2508	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b5f2d076c4922093e9e8efb48761218_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b5f2d076c4922093e9e8efb48761218_JaffaCakes118.dll,#1
  2⤵
  PID:2352