3f02e8b4f4e40392be955566f116ff1594e788f41388f311b6157220b847a804

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 01:03

Target

4c2c6d613ac9a7c119a194e92a28b041_JaffaCakes118.dll
Size

169KB
MD5

4c2c6d613ac9a7c119a194e92a28b041
SHA1

a31378f1e851a9d24ce45045f10004725eb8c20e
SHA256

3f02e8b4f4e40392be955566f116ff1594e788f41388f311b6157220b847a804
SHA512

bfef43d83eb73effd8b2327dc37ba00decb160ff96d6f2b3cbd4166f975d49cc3ea86647136b51046e0ff62b5157759565ec18a0144bf2143adc457f040e57a5
SSDEEP

3072:vcgOPyMfbpji5F9xB1DpafD0Je9eknGjFLSsGrLP6aytkKkgZz:11MfRiTl1DJ89rnGhQ6Xr1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2456	2292	rundll32.exe	30
PID 2292 wrote to memory of 2456	2292	rundll32.exe	30
PID 2292 wrote to memory of 2456	2292	rundll32.exe	30
PID 2292 wrote to memory of 2456	2292	rundll32.exe	30
PID 2292 wrote to memory of 2456	2292	rundll32.exe	30
PID 2292 wrote to memory of 2456	2292	rundll32.exe	30
PID 2292 wrote to memory of 2456	2292	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c2c6d613ac9a7c119a194e92a28b041_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c2c6d613ac9a7c119a194e92a28b041_JaffaCakes118.dll,#1
  2⤵
  PID:2456