756b359340f6bf95b793203d71e6957a3b75d6b85cebdcc265f7c781b352d8ac

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 01:24

Target

18480621c232e92cafde29c2d4c41584_JaffaCakes118.dll
Size

32KB
MD5

18480621c232e92cafde29c2d4c41584
SHA1

f2141a6f74ece3ff8faa42eba9837190ac561141
SHA256

756b359340f6bf95b793203d71e6957a3b75d6b85cebdcc265f7c781b352d8ac
SHA512

2836aac880b5b2f323049220b61a34d4e7f27f13f03661d03d96de41fc244888fecb8b89612e472f52393bdf2c71d26f205d363853af238439381340d8455fac
SSDEEP

768:JK/ruueBN8nyMfbqx/FI7Glp25hqD5jyRKYqK:J+ruue4bYa7GPcklyRKYb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1796	1708	rundll32.exe	28
PID 1708 wrote to memory of 1796	1708	rundll32.exe	28
PID 1708 wrote to memory of 1796	1708	rundll32.exe	28
PID 1708 wrote to memory of 1796	1708	rundll32.exe	28
PID 1708 wrote to memory of 1796	1708	rundll32.exe	28
PID 1708 wrote to memory of 1796	1708	rundll32.exe	28
PID 1708 wrote to memory of 1796	1708	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\18480621c232e92cafde29c2d4c41584_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\18480621c232e92cafde29c2d4c41584_JaffaCakes118.dll,#1
  2⤵
  PID:1796