3abe4935ac0314f214f24c6baf602f7176094605a19668f6ab8c0e01ce6e3214

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 12:28

Target

30607e9c49ddf864cd2dae20d3bcaeb3_JaffaCakes118.dll
Size

351KB
MD5

30607e9c49ddf864cd2dae20d3bcaeb3
SHA1

0954a117c277f24719c5b69dbc54ec939c6b438b
SHA256

3abe4935ac0314f214f24c6baf602f7176094605a19668f6ab8c0e01ce6e3214
SHA512

021bf6df71f119dd461d2912482eddff470782a2543ceb53d4c86a30e73d56dac9097f953353fe22c51fcf732dd1b1c3bb53424a936826eb7bcece303921457f
SSDEEP

6144:1zoQwAX04rl4OaexuV43BY/qsQXizO/tHuRpxDUUxsKqV2NWZgnt9Z:RoQ84rl4tWuCBY/qsQXizO/luRpxDUUF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2204	1692	rundll32.exe	30
PID 1692 wrote to memory of 2204	1692	rundll32.exe	30
PID 1692 wrote to memory of 2204	1692	rundll32.exe	30
PID 1692 wrote to memory of 2204	1692	rundll32.exe	30
PID 1692 wrote to memory of 2204	1692	rundll32.exe	30
PID 1692 wrote to memory of 2204	1692	rundll32.exe	30
PID 1692 wrote to memory of 2204	1692	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\30607e9c49ddf864cd2dae20d3bcaeb3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\30607e9c49ddf864cd2dae20d3bcaeb3_JaffaCakes118.dll,#1
  2⤵
  PID:2204