2833d38400d5ac34b74cae71561d681e3fd244bab51cda887587584094c07b09

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 11:14

Target

4e101111c02810d85a3690e3a196abc8_JaffaCakes118.dll
Size

34KB
MD5

4e101111c02810d85a3690e3a196abc8
SHA1

b0e517a7f43d9f027a40bc4c7170d9a6b10d39dc
SHA256

2833d38400d5ac34b74cae71561d681e3fd244bab51cda887587584094c07b09
SHA512

8e8728c2c870d829da96bd6960402e76fc1dec4975845006c71df273da74bb10f097a501eaeea0013cfa444987ed4583aa9a3d619a95b38db2e3e559223ff46b
SSDEEP

768:JHeHq51szazGUQYkIJu4Pp88LXmW+hnS1uaRvv0:wHq51saDW8nMnSkavv0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 1880	1828	rundll32.exe	30
PID 1828 wrote to memory of 1880	1828	rundll32.exe	30
PID 1828 wrote to memory of 1880	1828	rundll32.exe	30
PID 1828 wrote to memory of 1880	1828	rundll32.exe	30
PID 1828 wrote to memory of 1880	1828	rundll32.exe	30
PID 1828 wrote to memory of 1880	1828	rundll32.exe	30
PID 1828 wrote to memory of 1880	1828	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e101111c02810d85a3690e3a196abc8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e101111c02810d85a3690e3a196abc8_JaffaCakes118.dll,#1
  2⤵
  PID:1880