47c20f9b6dc3229bf5ab6a2923aac30a1f6cb07efb144afd68baf10a307eb152

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 09:01

Target

629cd001963c4ea9bec5e25074b3b28c_JaffaCakes118.dll
Size

5KB
MD5

629cd001963c4ea9bec5e25074b3b28c
SHA1

c290ad16828b6690007e5815d62316db3845ac70
SHA256

47c20f9b6dc3229bf5ab6a2923aac30a1f6cb07efb144afd68baf10a307eb152
SHA512

561c5d53b110fe7e614c3893e21fc1a4841e4f8c36769f896fddab3f40f3e64f8009b7274011e37349d3255a056e5b2438fdc92cbc6d3082d7ee4abb33acf19b
SSDEEP

96:5l8hHqR63yChYvOJ0fuYk9SSFKsvqBn9rXdwTpO8FIpY:7x2yChYvOJ0fuYO7KsvqlVdSE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2860	2180	rundll32.exe	30
PID 2180 wrote to memory of 2860	2180	rundll32.exe	30
PID 2180 wrote to memory of 2860	2180	rundll32.exe	30
PID 2180 wrote to memory of 2860	2180	rundll32.exe	30
PID 2180 wrote to memory of 2860	2180	rundll32.exe	30
PID 2180 wrote to memory of 2860	2180	rundll32.exe	30
PID 2180 wrote to memory of 2860	2180	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\629cd001963c4ea9bec5e25074b3b28c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\629cd001963c4ea9bec5e25074b3b28c_JaffaCakes118.dll,#1
  2⤵
  PID:2860