a2a47ad610c4b58d413fb7b86ff3d6bac45dafeef3285d84eedec2c1e566d251

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 16:51

Target

63fdb4cac9e45c2602d3cc2f0fd877be_JaffaCakes118.dll
Size

105KB
MD5

63fdb4cac9e45c2602d3cc2f0fd877be
SHA1

49faaefc0e965e36717b62f3d18c063974a49a12
SHA256

a2a47ad610c4b58d413fb7b86ff3d6bac45dafeef3285d84eedec2c1e566d251
SHA512

d5ecd3adb2e9ce222ee3a933b32fd8519d722efb37210f2437ce8a40f38568a07bfc0eda46c4b532732846c1058e904fc619bc701b8afad9679c3a47ce2916e4
SSDEEP

3072:k5g8C/he8AqcOXBNsSVlLDn5U1eJNnSALgc:OnC/wCtucdr5U1ernN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1040	2136	rundll32.exe	30
PID 2136 wrote to memory of 1040	2136	rundll32.exe	30
PID 2136 wrote to memory of 1040	2136	rundll32.exe	30
PID 2136 wrote to memory of 1040	2136	rundll32.exe	30
PID 2136 wrote to memory of 1040	2136	rundll32.exe	30
PID 2136 wrote to memory of 1040	2136	rundll32.exe	30
PID 2136 wrote to memory of 1040	2136	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\63fdb4cac9e45c2602d3cc2f0fd877be_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\63fdb4cac9e45c2602d3cc2f0fd877be_JaffaCakes118.dll,#1
  2⤵
  PID:1040