297d644d497e70c8144b5aabccb203ddd4d244dc71ca6adfdfe8cbcdc7f3bc70

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 15:50

Target

30ff825e855cccb4dac038a51ba4eda1_JaffaCakes118.dll
Size

32KB
MD5

30ff825e855cccb4dac038a51ba4eda1
SHA1

b6105228b386338ff057f0ff78b01e70de257ef9
SHA256

297d644d497e70c8144b5aabccb203ddd4d244dc71ca6adfdfe8cbcdc7f3bc70
SHA512

70449a72b172f0f3137bee5d0eaec3e93c15e349058f59f4507305f41025fca884c47220bb2dd4902b20217da11c8973ced353b7aba93b28605dd7d30269e057
SSDEEP

768:at+NP27D6a8deklv/LT7PlhXlK9VfShVfLRBQ2I7:at+p272es/7PlhVK3aHDRU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 1296	2824	rundll32.exe	30
PID 2824 wrote to memory of 1296	2824	rundll32.exe	30
PID 2824 wrote to memory of 1296	2824	rundll32.exe	30
PID 2824 wrote to memory of 1296	2824	rundll32.exe	30
PID 2824 wrote to memory of 1296	2824	rundll32.exe	30
PID 2824 wrote to memory of 1296	2824	rundll32.exe	30
PID 2824 wrote to memory of 1296	2824	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\30ff825e855cccb4dac038a51ba4eda1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\30ff825e855cccb4dac038a51ba4eda1_JaffaCakes118.dll,#1
  2⤵
  PID:1296