ffc3fa6b0a062d7ade0f5c019bd6489b64dcf8eeaf2ad766cd724ad5030f15d9

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 05:58

Target

036e7187f84affa70dc609393119c616_JaffaCakes118.dll
Size

25KB
MD5

036e7187f84affa70dc609393119c616
SHA1

8a544f0aa25f720300dbc65ae047114e9b291426
SHA256

ffc3fa6b0a062d7ade0f5c019bd6489b64dcf8eeaf2ad766cd724ad5030f15d9
SHA512

1aa9edd8b84d8571b0cbfea32bfe018360ed35088f846816c272558e573632f7573ccd665315a059a930569c303203b7527c43b5e7579e6b846b151a9d1e4d06
SSDEEP

384:W+X9N4N+ApWm3yprKYaRbD3KR77DIzRh9FNaYN728EaRZnkH:W+LAw8y4YaRqR74zRhj0YN7fRdkH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\036e7187f84affa70dc609393119c616_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\036e7187f84affa70dc609393119c616_JaffaCakes118.dll,#1
  2⤵
  PID:2196