572d5ffe5c572e01524a01b61b98b49446c6b8cb20c279073b3452c7953564d3

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 19:38

Target

64866c09cfd94ea12c212c50bf174059_JaffaCakes118.dll
Size

32KB
MD5

64866c09cfd94ea12c212c50bf174059
SHA1

a2ce8b639e20a4acd8a00c1963160e0a37cf06b9
SHA256

572d5ffe5c572e01524a01b61b98b49446c6b8cb20c279073b3452c7953564d3
SHA512

a4d69e533c84276387c9d87aa40965fc5af8c3e44e3af1c9166bf6965486aba514230e0ef04be76a3093cb83a104d2f3bef643671d0831dc09173d428c37f4ff
SSDEEP

768:bIh6p/HSZlfvKppbJ17vyfrxOVOGKLRqMjGf:E6pNppj7afryERqMjGf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2484	2316	rundll32.exe	30
PID 2316 wrote to memory of 2484	2316	rundll32.exe	30
PID 2316 wrote to memory of 2484	2316	rundll32.exe	30
PID 2316 wrote to memory of 2484	2316	rundll32.exe	30
PID 2316 wrote to memory of 2484	2316	rundll32.exe	30
PID 2316 wrote to memory of 2484	2316	rundll32.exe	30
PID 2316 wrote to memory of 2484	2316	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64866c09cfd94ea12c212c50bf174059_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64866c09cfd94ea12c212c50bf174059_JaffaCakes118.dll,#1
  2⤵
  PID:2484