c3fc26f9bce886bf50d8ba2ae03056e3005e223c62bafea8c3339a6aab08ecf1

Analysis

max time kernel
12s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 19:05

Target

2d7ccb349178bcf46208adee0140c8a7_JaffaCakes118.dll
Size

165KB
MD5

2d7ccb349178bcf46208adee0140c8a7
SHA1

3a2686c5c7fbd3feb72f9b6fdf2f46022f08b7b0
SHA256

c3fc26f9bce886bf50d8ba2ae03056e3005e223c62bafea8c3339a6aab08ecf1
SHA512

62c4b71a168d092f96153f07349e755f187a3cc7cacf446e3d20f395a39e63f0476294f223b04a895e12275c2c12d1d1d01a4d3191b45dd8333044656aae64e7
SSDEEP

3072:8QkBbkHDzoUiiux3+S0RcNBHca8WpWTyV63p+4DDUUo0moJyOq:NkhkH3qiux3dNoARVcp9DUUdm+yT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 1168	1360	rundll32.exe	29
PID 1360 wrote to memory of 1168	1360	rundll32.exe	29
PID 1360 wrote to memory of 1168	1360	rundll32.exe	29
PID 1360 wrote to memory of 1168	1360	rundll32.exe	29
PID 1360 wrote to memory of 1168	1360	rundll32.exe	29
PID 1360 wrote to memory of 1168	1360	rundll32.exe	29
PID 1360 wrote to memory of 1168	1360	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d7ccb349178bcf46208adee0140c8a7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d7ccb349178bcf46208adee0140c8a7_JaffaCakes118.dll,#1
  2⤵
  PID:1168