d0ae197e9c27b96d6ad92e3dbec53aa4611d3baef04c49cc08130861b61df982

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 04:59

Target

5f1bfc73062358de1a24119db5cde154_JaffaCakes118.dll
Size

44KB
MD5

5f1bfc73062358de1a24119db5cde154
SHA1

2e96867969c97a3dfd9c45d7e21c5a1a88d7b525
SHA256

d0ae197e9c27b96d6ad92e3dbec53aa4611d3baef04c49cc08130861b61df982
SHA512

376ad47fd7ce6d57930029820d33a104ee9ef4cb417a506b5fff906ebd586f51fecbbe7bd19f6738601632c335323c6214e26db92d73d6bd6d11bafe5e2492ff
SSDEEP

768:P8DxHbWKNaaAhTM+DF4Ks+jrLohU5BGUVja3Z3J3RhcJ:gJOTM+DF4hGohU5BGUVIZ3J3Rhc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2324	3048	rundll32.exe	31
PID 3048 wrote to memory of 2324	3048	rundll32.exe	31
PID 3048 wrote to memory of 2324	3048	rundll32.exe	31
PID 3048 wrote to memory of 2324	3048	rundll32.exe	31
PID 3048 wrote to memory of 2324	3048	rundll32.exe	31
PID 3048 wrote to memory of 2324	3048	rundll32.exe	31
PID 3048 wrote to memory of 2324	3048	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f1bfc73062358de1a24119db5cde154_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f1bfc73062358de1a24119db5cde154_JaffaCakes118.dll,#1
  2⤵
  PID:2324