00f47c7b90ba131ff8d901da9ef7f44199b2903c97a5f366d65339a06ab27b2f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 13:06

Target

2c75d5f745590117d47e559721fed7ae_JaffaCakes118.dll
Size

69KB
MD5

2c75d5f745590117d47e559721fed7ae
SHA1

86a781428012b3c8e744c37c328713454791ad17
SHA256

00f47c7b90ba131ff8d901da9ef7f44199b2903c97a5f366d65339a06ab27b2f
SHA512

25842bbf7ec40597b4d7aa6a56341ef7617a90823bfb581b00215785562a793cbf736aa3a0b9bccaafd5d56e7ce1262df725bc3b734c6bd2a8045689620b7991
SSDEEP

1536:LX4yBiWl7jQazA+4FnToIfPNNpaWSy1f2THR6Du:L3LzA+4tTBfPNNYWnYT0u

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2764	2760	rundll32.exe	30
PID 2760 wrote to memory of 2764	2760	rundll32.exe	30
PID 2760 wrote to memory of 2764	2760	rundll32.exe	30
PID 2760 wrote to memory of 2764	2760	rundll32.exe	30
PID 2760 wrote to memory of 2764	2760	rundll32.exe	30
PID 2760 wrote to memory of 2764	2760	rundll32.exe	30
PID 2760 wrote to memory of 2764	2760	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c75d5f745590117d47e559721fed7ae_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c75d5f745590117d47e559721fed7ae_JaffaCakes118.dll,#1
  2⤵
  PID:2764