0a7018464a64e068177c1456a8c5258355b535ef99be83908eb449947f187125

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 07:19

Target

4d4e0fd37650c3d91dc629acc2019fca_JaffaCakes118.dll
Size

8KB
MD5

4d4e0fd37650c3d91dc629acc2019fca
SHA1

d40e5b6f510a91fc49430b73b706dc5b62a47ce8
SHA256

0a7018464a64e068177c1456a8c5258355b535ef99be83908eb449947f187125
SHA512

258f5e08ebfe117fe8ea21ce080b41165e3ad61ee53fc35fe0fd9fa9c263a32f93c34b5898296a27eb620ca62b83c3f7df39daa5e7c323401ca9dc24ef8d2779
SSDEEP

96:gdbZPmn/Ujl+6MqMxj6vNO9Q0tThhR2AhIXH3XAtbSlf4cWM7zqhTnOQC7tCE1/:SwWtJUJx/tEH3X2OZ4AihzOB1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2552	2248	rundll32.exe	30
PID 2248 wrote to memory of 2552	2248	rundll32.exe	30
PID 2248 wrote to memory of 2552	2248	rundll32.exe	30
PID 2248 wrote to memory of 2552	2248	rundll32.exe	30
PID 2248 wrote to memory of 2552	2248	rundll32.exe	30
PID 2248 wrote to memory of 2552	2248	rundll32.exe	30
PID 2248 wrote to memory of 2552	2248	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d4e0fd37650c3d91dc629acc2019fca_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d4e0fd37650c3d91dc629acc2019fca_JaffaCakes118.dll,#1
  2⤵
  PID:2552