4472ab9b3cde7d57fc5c400c5c69d889c563a4fa36522c3f7d89317c176cba34

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 10:28

Target

601e58576d06ae8e7e30e3913cd3aa38_JaffaCakes118.dll
Size

106KB
MD5

601e58576d06ae8e7e30e3913cd3aa38
SHA1

23ee06716966856db37db035252d53ac97d4ceaf
SHA256

4472ab9b3cde7d57fc5c400c5c69d889c563a4fa36522c3f7d89317c176cba34
SHA512

0e5c5017e670aff5a5926b363d012bdfd6de3baae0646ed2a125a6c81f33854cc8c01090fb075aec991cc6f3983119470336236d677d02d8340201c7f3c4e653
SSDEEP

1536:KCYEOtQmrEkjK6TFtdveyoTc2lBfcw+iP+LqKLtUJppVnjwx:ROTE9WveyoThlxcw+g+5LtUJppVnjwx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2808	2628	rundll32.exe	31
PID 2628 wrote to memory of 2808	2628	rundll32.exe	31
PID 2628 wrote to memory of 2808	2628	rundll32.exe	31
PID 2628 wrote to memory of 2808	2628	rundll32.exe	31
PID 2628 wrote to memory of 2808	2628	rundll32.exe	31
PID 2628 wrote to memory of 2808	2628	rundll32.exe	31
PID 2628 wrote to memory of 2808	2628	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\601e58576d06ae8e7e30e3913cd3aa38_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\601e58576d06ae8e7e30e3913cd3aa38_JaffaCakes118.dll,#1
  2⤵
  PID:2808