f202c26a83e93cd75c462a49847db11cc39a289fc5d7bbd481a40c92cc1351f1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 06:08 UTC

Target

666c58dd41912cdd9e59551791319852_JaffaCakes118.dll
Size

16KB
MD5

666c58dd41912cdd9e59551791319852
SHA1

4225f5d0ab7fb736338578afa5a0f3b469f9a68c
SHA256

f202c26a83e93cd75c462a49847db11cc39a289fc5d7bbd481a40c92cc1351f1
SHA512

83ed522ecf8fc1e834de839b5f5a7c9b3913e022c03abaa8b30f5052ceaf226054f659bf763faf3e6dae0ea00eeb2b838ee9d8e780740b385c728b7a17e9ae3b
SSDEEP

192:DG93JrcCNXQSi084aYgwgvSLtyxOq26mLBcbjyafAVkn5KqDDd2fIAmPzbWjM2F:DGvPX7V9ax/KZyxODAyaIw5zDuUKPF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2232	2104	rundll32.exe	30
PID 2104 wrote to memory of 2232	2104	rundll32.exe	30
PID 2104 wrote to memory of 2232	2104	rundll32.exe	30
PID 2104 wrote to memory of 2232	2104	rundll32.exe	30
PID 2104 wrote to memory of 2232	2104	rundll32.exe	30
PID 2104 wrote to memory of 2232	2104	rundll32.exe	30
PID 2104 wrote to memory of 2232	2104	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\666c58dd41912cdd9e59551791319852_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\666c58dd41912cdd9e59551791319852_JaffaCakes118.dll,#1
  2⤵
  PID:2232