595e1ded8fba0410a193965849129c3b490fb22b5ff7f20baed30e896c177299

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 21:17

Target

2dd5016a3c414f3b58c95233dbe70f0d_JaffaCakes118.dll
Size

245KB
MD5

2dd5016a3c414f3b58c95233dbe70f0d
SHA1

967cea8cbdb9e76076b09b6aceded5f7cb4ed352
SHA256

595e1ded8fba0410a193965849129c3b490fb22b5ff7f20baed30e896c177299
SHA512

370a58536148e6438d597a8bf423bd3c6234d30e7399e55e198dc10b1ac53959331308300536e176c80076914146ecbd2af8733b866255de0c032e5818b653b8
SSDEEP

6144:c1z0udGmilo5qfOjtxn+ZSCAzQoamt8qmVNhV0NBvba0EPH:TEn6A0oamt8qC0v

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 836	2904	rundll32.exe	29
PID 2904 wrote to memory of 836	2904	rundll32.exe	29
PID 2904 wrote to memory of 836	2904	rundll32.exe	29
PID 2904 wrote to memory of 836	2904	rundll32.exe	29
PID 2904 wrote to memory of 836	2904	rundll32.exe	29
PID 2904 wrote to memory of 836	2904	rundll32.exe	29
PID 2904 wrote to memory of 836	2904	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2dd5016a3c414f3b58c95233dbe70f0d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2dd5016a3c414f3b58c95233dbe70f0d_JaffaCakes118.dll,#1
  2⤵
  PID:836