16eeb5e054c1835e5b2ab9fb36935217a269bd9d98a9d88ab90ae37376ef54d0

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 09:39

Target

4dc0e6a45d877a0760103c00738f6651_JaffaCakes118.dll
Size

6KB
MD5

4dc0e6a45d877a0760103c00738f6651
SHA1

b9ca3de0c637cba1eb6028f2eb2073d09e8323be
SHA256

16eeb5e054c1835e5b2ab9fb36935217a269bd9d98a9d88ab90ae37376ef54d0
SHA512

f7adb501a5eaef1446ad9ffd6b8c3a94c31f4d13b7a47fc655fb41a5feedcb6458487d48831e0a6aae206b7c54718c01b9e9c3d177fd2e86f0d00a00b75230ac
SSDEEP

96:nPzPo6uzAuAqlEOCksTWPlCrg7ej4X/J3EEPX4P7Kk6P1nR6s:n7Po6MAyuOxXlrdZEEPVk6tnJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 1884	2144	rundll32.exe	28
PID 2144 wrote to memory of 1884	2144	rundll32.exe	28
PID 2144 wrote to memory of 1884	2144	rundll32.exe	28
PID 2144 wrote to memory of 1884	2144	rundll32.exe	28
PID 2144 wrote to memory of 1884	2144	rundll32.exe	28
PID 2144 wrote to memory of 1884	2144	rundll32.exe	28
PID 2144 wrote to memory of 1884	2144	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dc0e6a45d877a0760103c00738f6651_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dc0e6a45d877a0760103c00738f6651_JaffaCakes118.dll,#1
  2⤵
  PID:1884