13c1f221a67b9f8e2bbe349a5ac276e622df4934a029ba98fc4fb4bdf488e309

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 01:12

Target

31fa82053236b783f6f8ba78f1f4394b_JaffaCakes118.dll
Size

192KB
MD5

31fa82053236b783f6f8ba78f1f4394b
SHA1

0bd856065db16c9d268428df5b4c2c63c08bf4fd
SHA256

13c1f221a67b9f8e2bbe349a5ac276e622df4934a029ba98fc4fb4bdf488e309
SHA512

b2ccd2ef0e9ac28aa7dfe4e9121a42a031c8857a5276c6604e1e5a4e60c1889e4479c841796ea8a8b3f61f7bf054cf1a9aea0c9bdf092cdc26dc1cf00a63d046
SSDEEP

3072:lfbadK63WF69TLbnNeZmT6w+/2sJV6eewGMTi/GY5wdvY5:odV3d9TngZ26wDzv/3uO5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 1724	1036	rundll32.exe	28
PID 1036 wrote to memory of 1724	1036	rundll32.exe	28
PID 1036 wrote to memory of 1724	1036	rundll32.exe	28
PID 1036 wrote to memory of 1724	1036	rundll32.exe	28
PID 1036 wrote to memory of 1724	1036	rundll32.exe	28
PID 1036 wrote to memory of 1724	1036	rundll32.exe	28
PID 1036 wrote to memory of 1724	1036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31fa82053236b783f6f8ba78f1f4394b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31fa82053236b783f6f8ba78f1f4394b_JaffaCakes118.dll,#1
  2⤵
  PID:1724