89a84e1377ab42876203022d3a2497dcf8a0841e93549c4e882b0cb04316341d

Analysis

max time kernel
10s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 08:50

Target

4d9a285a7dab6d63e57dd7d088077230_JaffaCakes118.dll
Size

76KB
MD5

4d9a285a7dab6d63e57dd7d088077230
SHA1

2507cd637f6013b43f4298927c94cb520e4832fe
SHA256

89a84e1377ab42876203022d3a2497dcf8a0841e93549c4e882b0cb04316341d
SHA512

66f3d856d1829895b54fabcef4fb2786c62237234aa93cf7d6a54267565817be2210bfbeb6db8d664a3ad6f1f61783c73a373e6ff41562dd6e3612c7008c8e4c
SSDEEP

1536:s0m7IwTgP2Q0H1roTVIBwmTdWyWt5sQ7g:sFIYgObrutt5sQ7g

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2520	1316	rundll32.exe	30
PID 1316 wrote to memory of 2520	1316	rundll32.exe	30
PID 1316 wrote to memory of 2520	1316	rundll32.exe	30
PID 1316 wrote to memory of 2520	1316	rundll32.exe	30
PID 1316 wrote to memory of 2520	1316	rundll32.exe	30
PID 1316 wrote to memory of 2520	1316	rundll32.exe	30
PID 1316 wrote to memory of 2520	1316	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d9a285a7dab6d63e57dd7d088077230_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d9a285a7dab6d63e57dd7d088077230_JaffaCakes118.dll,#1
  2⤵
  PID:2520