4b40d2dc87a41f6e88434b3e55cfd6bfe3dde9d962871eb3c6d4ab048fda300e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 04:46

Target

5a844ad6de29827824f178d282fc7227_JaffaCakes118.dll
Size

38KB
MD5

5a844ad6de29827824f178d282fc7227
SHA1

d3edbb27efb01671736f0203d23067d7a236c231
SHA256

4b40d2dc87a41f6e88434b3e55cfd6bfe3dde9d962871eb3c6d4ab048fda300e
SHA512

b9d8463dde17f86a828f94ca9c242622ad0dc3cc897f2d6472687cd98f78d9b5565d4c010db161dd63548737ffb3fd2d5839c18a0952d9287270fea6f9e17b66
SSDEEP

768:6iU7TW9AKgSjMyqatfvv08RMdowFOFhxdqmdqILnOtKCwQ:/U3W9A6lxvv08RFwFOFhxdzdHLnOtKC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1952	2128	rundll32.exe	30
PID 2128 wrote to memory of 1952	2128	rundll32.exe	30
PID 2128 wrote to memory of 1952	2128	rundll32.exe	30
PID 2128 wrote to memory of 1952	2128	rundll32.exe	30
PID 2128 wrote to memory of 1952	2128	rundll32.exe	30
PID 2128 wrote to memory of 1952	2128	rundll32.exe	30
PID 2128 wrote to memory of 1952	2128	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a844ad6de29827824f178d282fc7227_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a844ad6de29827824f178d282fc7227_JaffaCakes118.dll,#1
  2⤵
  PID:1952