d2169e06ca319df6325b99a8ae95396f546ffdbb2db8ffd1ce3cdc09acbbe532

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 03:31

Target

5a4c68da3c7dc2a40db72e00c831310b_JaffaCakes118.dll
Size

68KB
MD5

5a4c68da3c7dc2a40db72e00c831310b
SHA1

9fd50751003718823c70f1b47f288763b04d0bb5
SHA256

d2169e06ca319df6325b99a8ae95396f546ffdbb2db8ffd1ce3cdc09acbbe532
SHA512

0b8a478f425c320db9d7fe7dacc3a5b2508967ee3bba810e5ea5b2db0860cc50125a8f4747c3540d67e37d543b5d5f084754ebc20a6c5aa4c70a6ff631491ac3
SSDEEP

768:UJo2aLF4TQ4HLgFg+ZmQzmvU4TdIG57WuMeScfC5LmjRxa34r2ozrX:aaR4WgakNTdh8uMeSmm0xxqozr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 2032	1840	rundll32.exe	31
PID 1840 wrote to memory of 2032	1840	rundll32.exe	31
PID 1840 wrote to memory of 2032	1840	rundll32.exe	31
PID 1840 wrote to memory of 2032	1840	rundll32.exe	31
PID 1840 wrote to memory of 2032	1840	rundll32.exe	31
PID 1840 wrote to memory of 2032	1840	rundll32.exe	31
PID 1840 wrote to memory of 2032	1840	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a4c68da3c7dc2a40db72e00c831310b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a4c68da3c7dc2a40db72e00c831310b_JaffaCakes118.dll,#1
  2⤵
  PID:2032