e81551dfb4fd4f65a9aa7fc1f692d2d25a4bc34c795d718bef80ba10260e50a5

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 01:27

Target

59e74a711464ad2f220faf8e74060866_JaffaCakes118.dll
Size

141KB
MD5

59e74a711464ad2f220faf8e74060866
SHA1

ad152ea674fc0d40120f39e13fcb543011553d18
SHA256

e81551dfb4fd4f65a9aa7fc1f692d2d25a4bc34c795d718bef80ba10260e50a5
SHA512

05966f7b946d10ab2819e6d3473be6a09a09c892076a4c5d8b9f73997fd58df1e05525ac05c703cb4c54cf4a9cb601a1258379801f0e845c1e0c0a7c0150ba0d
SSDEEP

3072:6ECAJhkdOP17s/qaOi08OwyHxcnZGCCXl11PllV1V:6EvgOP17s/F08OaoCC1vl1V

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2208	2548	rundll32.exe	30
PID 2548 wrote to memory of 2208	2548	rundll32.exe	30
PID 2548 wrote to memory of 2208	2548	rundll32.exe	30
PID 2548 wrote to memory of 2208	2548	rundll32.exe	30
PID 2548 wrote to memory of 2208	2548	rundll32.exe	30
PID 2548 wrote to memory of 2208	2548	rundll32.exe	30
PID 2548 wrote to memory of 2208	2548	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59e74a711464ad2f220faf8e74060866_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59e74a711464ad2f220faf8e74060866_JaffaCakes118.dll,#1
  2⤵
  PID:2208